SENATE COMMITTEE ON APPROPRIATIONS

Senator Anthony Portantino, Chair

2019 - 2020 Regular Session

SB 561 (Jackson) - California Consumer Privacy Act of 2018: consumer remedies

Bill Summary:

SB 561 would expand a consumer’s ability to bring a civil action for violations of rights granted by the California Consumer Privacy Act of 2018 and would remove the ability of a business to cure an alleged violation of the act within 30 days to remain in compliance.

Fiscal Impact:

• Courts: Unknown, potentially-significant workload cost pressures to the courts to adjudicate lawsuits filed by consumers for alleged violations of rights granted by the act. While the superior courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources. For example, the governor's proposed 2019-20 budget seeks to appropriate $52.5 million from the General Fund to backfill continued reduction in fine and penalty revenue for trial court operations. (General Fund*)

• Department of Justice: The department has indicated that there would be no new costs to provide general guidance on compliance with the act.

*Trial Court Trust Fund

Background:

Starting January 1, 2020, the California Consumer Privacy Act of 2018 grants a consumer various rights with regard to personal information relating to that consumer that is held by a business, including the right to know what personal information is collected by a business and to have information held by that business deleted, as specified. Additionally, the act grants a consumer the right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of third parties with which the information is shared and the right to request that a business that sells the consumer’s personal information, or discloses it for a business purpose, disclose the categories of information that it collects, the categories of information, and the categories of third parties to which the information was sold or disclosed. A consumer whose nonencrypted or nonredacted personal information, as defined, is subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business’s failure to maintain reasonable security procedures may bring a civil action for various damages under the act.

Proposed Law:

This bill would:

• Allow any consumer whose rights under the California Consumer Privacy Act of 2018 are violated to institute a civil action for any of the following:
  • To recover the greater of actual damages or statutory damages of between $100 and $750 per consumer per incident.
  • Injunctive or declaratory relief.
  • Any other relief that the court deems proper.
• Replaces the ability of a business or a third party to seek an opinion of the Attorney General for guidance on how to comply with the act with allowing the Attorney General to publish material that provides businesses and others with general compliance guidance.
• Removes the ability of a business to cure any alleged violation within 30 days after being notified of alleged noncompliance with the act.

Related Legislation:

AB 375 (Chau, Ch. 55, Stats. 2018) established the California Consumer Privacy Act of 2018. SB 1121 (Dodd, Ch. 735, Stats. 2018) made a number of technical and clarifying amendments to the act.

There are a number of bills this session that seek to expand, create exceptions to, or otherwise amend the California Consumer Privacy Act of 2018. These include AB 25 (Chau, 2019), AB 846 (Burke, 2019), AB 873 (Irwin, 2019), AB 874 (Irwin, 2019), AB 981 (Daly, 2019), AB 1146 (Berman, 2019), AB 1355 (Chau, 2019), AB 1416 (Cooley, 2019), AB 1564 (Berman, 2019), AB 1760 (Wicks, 2019), and SB 753 (Stern, 2019)

Staff Comments:

The actual fiscal impact of SB 561 to the courts will depend on many unknown factors, including the numbers of violations alleged to have occurred, if the Attorney General would have filed a civil action absent the changes proposed by this measure, if parties settle before the filing of an action, and the factors unique to each case. While it is unknown how many actions for alleged violations consumers would file ultimately, it generally costs about $7,644 to operate a courtroom for one day. Additionally, it costs the court almost $2,900, on average, in personnel and resources to adjudicate a limited civil case and about $12,750, on average, in personnel and resources to adjudicate an unlimited civil case. These costs takes into consideration the time from when a petition or complaint is received by the court, processing and calendaring by the clerks, any hearings presided over by a judicial officer, and the finalizing of the outcome by the clerk. Consequently, if alleged violations of the California Consumer Privacy Act of 2018 that would not have been litigated by the Attorney General led to the filing of four or more new large cases, eighteen or more smaller cases, or a few complex cases that took longer than six days to adjudicate, the cost pressures to the court would surpass the Suspense File threshold. As indicated above, while the court is not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2019-2020 Regular Session

Bill No: SB 561 (Author:Jackson)

Version: February 22, 2019

Hearing Date: April 9, 2019

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

California Consumer Privacy Act of 2018: consumer remedies

DIGEST

This bill amends the private and consumer enforcement mechanisms in the California Consumer Privacy Act (CCPA). The bill also authorizes the Attorney General to provide general guidance on compliance with the CCPA.

EXECUTIVE SUMMARY

The California Consumer Privacy Act of 2018 (CCPA) provides a very limited consumer enforcement mechanism limited to data breaches. Otherwise, the responsibility for enforcing the CCPA and holding violators accountable falls completely on the Attorney General’s Office (AGO). Furthermore, when the AGO uncovers violations of the CCPA, the AGO must provide the entity in violation 30 days to “cure” their violations before the AGO is authorized to bring an enforcement action. The CCPA also provides that any business or third party may seek the legal opinion of the AGO.

In order to ensure more robust enforcement of the CCPA and to ensure that consumers can vindicate their rights, this bill expands the consumer enforcement mechanism, enabling consumers to enforce their own rights pursuant to the CCPA. The bill also removes the ability for violators to “cure” their violations of the law before the AGO is able to hold them accountable through an enforcement action. Finally, in order to avoid the potentially massive drain on public resources, the bill modifies the legal opinions provision of the law and instead authorizes the AGO to provide general guidance on compliance with the law.

This bill is sponsored by Attorney General Xavier Becerra who contends the bill is necessary to ensure “vigorous oversight and effective enforcement” of the CCPA’s protections. The bill is supported by various consumer groups. A number of business and advertising associations are among those in opposition.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Establishes the California Consumer Privacy Act of 2018 (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides that any consumer whose nonencrypted or nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action for any of the following:
3. to recover damages in an amount not less than $100 and not greater than $750 per consumer per incident or actual damages, whichever is greater;
4. injunctive or declaratory relief;
5. any other relief the court deems proper. (Civ. Code § 1798.150(a).)
6. Requires a consumer, before bringing a civil action to enforce the CCPA, to provide a business 30 days’ written notice identifying the specific provisions of the CCPA the consumer alleges have been or are being violated. If possible to cure and if within the 30 days the business actually cures the noticed violation and provides the consumer a statement indicating the cure and stating no further violations shall occur, no action for individual statutory damages or class-wide statutory damages may be initiated against the business. No notice shall be required prior to an individual consumer initiating an action solely for actual pecuniary damages suffered as a result of the alleged violations. If a business continues to violate the CCPA in breach of the statement required above, the consumer may initiate an action against the business and may pursue statutory damages for each breach, as well as other subsequent violations of the CCPA. (Civ. Code § 1798.150(b).)
7. Restricts the cause of action described above from applying to any other violation of the CCPA. The CCPA provides that nothing therein shall be interpreted to serve as the basis for a private right of action under any other law. (Civ. Code § 1798.150(c).)
8. Provides that any business or third party may seek the opinion of the Attorney General for guidance on how to comply with the provisions of the CCPA. (Civ. Code § 1798.155(a).)
9. Provides that a business shall be in violation of the CCPA if it fails to cure any alleged violation within 30 days after being notified of alleged noncompliance. Any business, service provider, or other person that violates the CCPA shall be subject to an injunction and liable for a civil penalty of not more than $2,500 for each violation or $7,500 for each violation that is proven to be intentional. Such penalties shall be exclusively assessed and recovered in a civil action brought by the Attorney General. (Civ. Code § 1798.155(b).)

This bill:

1. Extends the ability of a consumer to bring a civil action when any of the consumer’s rights under the CCPA are violated.
2. Authorizes the Attorney General to publish materials that provide businesses and others with general guidance on how to comply with the provisions of the CCPA. It removes the ability of any business or third party from seeking the opinion of the Attorney General.
3. Removes the ability of a business to cure alleged violations within 30 days of notice of a violation before the Attorney General is authorized to bring a civil action to enforce the CCPA.

COMMENTS

1. Protecting the fundamental right to privacy

Article I, Section 1 of the California Constitution provides: “All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy.” Privacy is therefore not just a policy goal, it is a constitutional right of every Californian. However, it has been under increasing assault.

The phrase “and privacy” was added to the California Constitution as a result of Proposition 11 in 1972; it was known as the “Privacy Initiative.” The arguments in favor of the amendment were written by Assemblymember Kenneth Cory and Senator George Moscone. The ballot pamphlet stated in relevant part:

At present there are no effective restraints on the information activities of government and business. This amendment creates a legal and enforceable right of privacy for every Californian. The right of privacy . . . prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes or to embarrass us. . . . The proliferation of government and business records over which we have no control limits our ability to control our personal lives. . . . Even more dangerous is the loss of control over the accuracy of government and business records on individuals. . . . Even if the existence of this information is known, few government agencies or private businesses permit individuals to review their files and correct errors. . . . Each time we apply for a credit card or a life insurance policy, file a tax return, interview for a job[,] or get a drivers' license, a dossier is opened and an informational profile is sketched.^[1]

In 1977, the Legislature reaffirmed that the right of privacy is a “personal and fundamental right” and that “all individuals have a right of privacy in information pertaining to them.”^[2] The Legislature further stated the following findings:

• “The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.”
• “The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.”
• “In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits.”

Although written almost 50 years ago, these concerns seem strikingly prescient. Today, the world’s most valuable resource is no longer oil, but data. Companies regularly and systematically collect, analyze, share, and sell the personal information of consumers. While this data collection provides consumers various benefits, public fears about the widespread, unregulated amassing of personal information have only grown since privacy was made a part of California’s Constitution.

In response to growing concerns about the privacy and safety of consumers’ data, proponents of the CCPA, a statewide ballot initiative, began collecting signatures in order to qualify it for the November 2018 election. The goal was to empower consumers to find out what information businesses were collecting on them and give them the choice to tell businesses to stop selling their personal information. In response to the pending initiative, which was subsequently withdrawn, AB 375 (Chau, Ch. 55, Stats. 2018) was introduced, quickly shepherded through the legislative process, and signed into law. The outcome was the California Consumer Privacy Act of 2018, Civil Code Section 1798.100 et seq.

The CCPA grants a set of rights to consumers with regard to their personal information, including enhanced notice and disclosure rights regarding information collection and use practices, access to the information collected, the right to delete certain information, the right to restrict the sale of information, and protection from discrimination for exercising these rights.

This bill does not limit or expand these rights; rather, it amends how these rights are enforced.

1. Stated intent of the bill

According to the author:

In response to the passage of the CCPA, the Attorney General’s Office submitted a letter to its authors calling attention to various issues with the provisions therein. The letter emphasized that while providing privacy protections is “critically important,” the CCPA, as it stands, presents “unworkable obligations and serious operational challenges.” This bill responds to the critical enforcement concerns highlighted by the Attorney General with three changes.

First, SB 561 ensures that the rights created by the CCPA are meaningful by authorizing consumers to take control and enforce their own rights. Because a right without a remedy is no right at all, we must act now to ensure consumers have the ability to enforce this important law.

Second, the bill eliminates the right to “cure” for violators of the law when the Attorney General is bringing an enforcement action. Providing violators this “get out of jail free card” undermines meaningful enforcement of the CCPA, weakens consumers’ rights, and disadvantages honest businesses that comply with the law.

Third, SB 561 protects taxpayers from the burden of providing legal advice to any business that wants it, and instead authorizes the Attorney General to publish general guidance on complying with the CCPA to benefit all businesses and third parties.

Attorney General Xavier Becerra, the sponsor of this bill, writes:

While the CCPA provides groundbreaking protections for consumers, it also imposes serious workability and operational challenges upon the Attorney General’s Office (AGO). These challenges will make it difficult for my office to carry out our oversight and enforcement duties under the CCPA. On numerous occasions, I have stated on the record that failure to address these flaws in the CCPA will undermine California’s authority to launch and sustain vigorous oversight and effective enforcement of the Act’s critical privacy protections.

1. Enforcement

The CCPA provides two forms of enforcement: (1) limited consumer enforcement and (2) conditional public enforcement by the Attorney General.

1. Private enforcement

The CCPA provides consumers the right to bring a civil action for statutory and actual damages in only one context, when the consumer’s nonencrypted or nonredacted personal information, as defined, is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information. Even before such an action can be brought, however, the consumer must provide the business 30 days written notice of the alleged violation (with certain exceptions) within which the business has the ability to “cure” the violation, where possible.

The CCPA further provides that nothing therein shall be interpreted to serve as the basis for a private right of action under any other law. Therefore, outside of the data breach context, consumers are unable to directly vindicate their rights under the law.

For instance, if a business is collecting the personal information of a young child without the parent or guardian’s consent, the child and the child’s parent or guardian are currently without a remedy under the CCPA.

The Attorney General addresses this weakness in consumer enforcement:

[T]he CCPA does not include a private right of action that would allow consumers to seek legal remedies for themselves and broadly enforce their privacy rights under the Act. Instead, the Act only gives consumers a limited right to sue if they become a victim of a data breach. There is something unfair about giving California’s consumers new rights but denying them the ability to protect themselves if those rights are violated. The lack of a private right of action, which would provide a critical adjunct to governmental enforcement, will substantially increase the AGO’s need for new enforcement resources.

SB 561 responds to these concerns by strengthening consumer enforcement. It empowers a consumer whose rights under the CCPA are violated to institute a civil action against those responsible. The bill therefore affords consumers access to justice by providing them the ability to vindicate their rights for all violations of the CCPA.

It should be noted that this change to the consumer enforcement mechanism does not modify the existing right to “cure” that businesses alleged to have violated the CCPA are afforded before a consumer can initiate a civil action.

1. Public enforcement

Outside of the above context, enforcement responsibilities are entirely the realm of the Attorney General. The CCPA provides that a business, service provider, or other person that violates its provisions may be subject to an injunction and civil penalties in a civil action brought in the name of the people of the State of California by the Attorney General.

However, before the Attorney General can hold a responsible party accountable for a violation of the CCPA through a civil action, the alleged violator must be provided with notice of the violation and given 30 days to cure any alleged violation. Essentially, a violation of the CCPA is not considered a violation until it remains uncured for 30 days from the point it was notified it was in violation.

The Attorney General has expressed grave concerns with providing businesses that violate the law with an ability to avoid accountability:

[T]he right-to-cure provision unfairly disadvantages honest businesses that comply with the law in the first place. The right to cure potentially incentivizes companies to break the law as a business decision, on the theory that fixing a violation will cost less than complying with the law in the first instance. Taking into account the low probability that their particular violation will immediately be detected and investigated by the AGO, some companies may decide it is an acceptable cost of doing business to ignore the law’s requirements if they have the right to cure the violation before facing liability for the decision.

In the end, honest businesses that bear the costs associated with early compliance are disadvantaged, not rewarded. Meanwhile, Californians’ privacy rights under the CCPA are jeopardized by businesses that choose not to follow the law unless or until they are given a notice and opportunity to cure. It is unfair to put someone at a competitive disadvantage because they chose to play by the rules.

This bill removes this provision. The Attorney General is entrusted by the people of California to exercise discretion in which crimes to prosecute and which violations of the law will be investigated and enforced with the resources of the office. This amendment to the CCPA acknowledges that fact. Given the limited resources and the scope of the oversight, the AGO is arguably more likely to focus its resources on larger, systematic violators of the CCPA. Allowing such bad actors to avoid accountability after the AGO has conducted a thorough investigation undermines the public enforcement mechanism in the law. This bill avoids that pitfall and removes the right to “cure” as to the public enforcement mechanism.

1. Attorney General’s legal guidance

The CCPA provides that “[a]ny business or third party may seek the opinion of the Attorney General for guidance on how to comply with the provisions of [the CCPA].” Although the language of this provision is slightly ambiguous, this provision may be interpreted to require the Attorney General to act as legal counsel for every entity that seeks it out in relation to CCPA compliance. Essentially, the very parties that may be in violation of the CCPA and that the Attorney General may be investigating, would be able to seek legal guidance from the Attorney General regardless of the resources available to them.

Under such a reading, large corporations could requisition the Attorney General as their own private legal counsel despite having ample resources with taxpayers paying the price. The Attorney General discusses his concerns with this provision:

Expecting the AGO to provide legal counsel at taxpayers’ expense to all inquiring businesses would be unprecedented. The AGO is not in the practice of using public funds to provide unlimited legal advice to private parties. This provision also creates a potential conflict of interest were the AGO to provide legal advice to parties who may be violating the privacy rights of Californians, the very people that the AGO is sworn to protect. What could be more unfair and unconscionable than to advantage violators of consumers’ privacy by providing them with legal counsel at taxpayer expense but leaving the victims of the privacy violation on their own?

SB 561 reworks this ambiguous provision of the CCPA to instead authorize the Attorney General to publish materials that provide businesses and other third parties with general guidance on how to comply with the CCPA.

1. Stakeholder positions on the bill

Consumer Watchdog explains its support for the bill:

First, because a right without a remedy is really no right at all, SB 561 ensures that consumers may seek justice and enforce their rights through civil actions for all violations of the CCPA. Second, SB 561 closes the loophole that allowed businesses to avoid accountability under the CCPA by removing the 30-day right to cure provision. Third, SB 561 authorizes the Office of the Attorney General to publish general CCPA compliance guidance to the benefit of all businesses and third parties.

Oakland Privacy and Media Alliance write in support of the bill, stating it “will go a long way towards polishing California’s Consumer Privacy Act into a more workable and effective piece of legislation that will protect consumers in an era of declining data security.”

Writing in support, Consumer Reports states:

This bill would address significant weaknesses in the CCPA. Consumer Reports took a “support if amended” position on AB 375 in 2018 in large part because of its weak enforcement provisions. The CCPA currently lacks sufficient enforcement to ensure that it is truly meaningful for consumer privacy. We are particularly troubled by the “right to cure” provision included in the legislation which, depending on how it is interpreted, may enable a business to evade all liability for behavior proscribed by the statute if it remedies its behavior within 30 days of receiving notice of noncompliance. Under this provision, a company might be able to flagrantly violate the law, and only cease its behavior once its privacy-invasive practices were discovered. Companies should not have to receive legal notice from the Attorney General before being legally responsible for following the law.

The Civil Justice Association of California, an association of businesses including Dow Chemical Company, PG&E, Monsanto, and Shell Oil Company, writes in opposition to the bill. It argues that the bill would “vastly broaden the right of consumers to sue for violations of California’s newly-enacted California Consumer Privacy Act (CCPA).” They argue changes such as these should be addressed at a later time.

In addition, a coalition of advertising associations writes in opposition. They argue that “eliminating businesses’ ability to seek the California Attorney General’s advice on ways to comply with the CCPA will cripple important, privacy-advancing conversations regulators and regulated entities could have about the law.” However, the bill does not prevent these conversations from taking place, but rather eliminates the possible legal mandate for the taxpayer-funded AGO to provide individualized, legal advice for every corporation and businesses in California. In fact, the AGO has been actively engaged with businesses and other stakeholders across the state as it carries out its informal rulemaking process. Forums have been held throughout California and the AGO has solicited feedback from a diverse array of parties. These conversations will continue to happen as the AGO executes its regulatory functions.

The advertising coalition further argues that eliminating the cure period with respect to AGO enforcement removes a “powerful way to incentivize businesses to quickly adjust their practices to meet the CCPA’s requirements.” However, the exact opposite conclusion is arguably more likely. The ability to cure before being penalized by the Attorney General may actually incentivize businesses not to comply with the CCPA where it benefits them and simply rely on the ability to cure if their violations are discovered by the Attorney General. Arguably, the ability of consumers and the AGO to enforce the law without conditions is an even stronger incentive for businesses to follow the law.

Finally, there have been a number of opponents to the bill that argue the expansion of the consumer enforcement mechanism breaks the “deal” that was made on the CCPA in 2018. From a constitutional perspective, one legislative body cannot limit or restrict its own power or that of subsequent Legislatures, and the act of one Legislature does not bind its successors. (In re Collie (1952) 38 Cal. 2d 396, 398, cert. denied, (1953) 345 U.S. 1000.) The power to legislate includes by necessary implication the power to amend existing legislation, and the amendment of a legislative act is itself a legislative act. (City of Sausalito v. County of Marin (1970) 12 Cal. App. 3d 550, 563-564.)

From a policy perspective, concerns about the operability of a law intended to benefit California’s consumers is arguably a sound basis to revisit any statute, previous agreements notwithstanding. Furthermore, the original initiative had a far broader consumer enforcement mechanism than that being proposed by this bill. The relevant provision read:

1798.108. Enforcement By Consumers Who Have Suffered An Injury In Fact.

1798.108. (a) A consumer who has suffered a violation of this Act may bring an action for statutory damages. For purposes of Business and Professions Code section 17204 and any other applicable law, a violation of this Act shall be deemed to constitute an injury in fact to the consumer who has suffered the violation, and the consumer need not suffer a loss of money or property as a result of the violation in order to bring an action for a violation of this Act.

(b)(l) Any consumer who suffers an injury in fact, as described in subdivision (a) of this section, shall recover statutory damages in the amount of one thousand dollars ($1,000) or actual damages, whichever is greater, for each violation from the business or person responsible for the violation, except that in the case of a knowing and willful violation by a business or person, an individual shall recover statutory damages of not less than one thousand dollars ($1,000) and not more than three thousand dollars ($3,000), or actual damages, whichever is greater, for each violation from the business or person responsible for the violation.

The initiative received far more than the minimum amount of signatures it needed, and proponents of the initiative have indicated the ballot measure was overwhelmingly supported by California’s voters with this broad enforcement provision in it. This sentiment has been reinforced by a recent ACLU/Binder Research poll. The poll focused on Californians’ positions on privacy legislation. Relevant here, the poll found that “94% want the right to take a company to court if they violate their privacy rights.”^[3] The evidence therefore supports the position that people want to be able to enforce their own rights.

The deal was negotiated on behalf of the people of California. The CCPA provides a number of rights to Californians as a part of the “deal” negotiated on their behalf. However, it does not provide Californians the ability to take a company to court when their privacy rights are violated, an ability that 94 percent of Californians desire. This bill gives Californians what they want.

SUPPORT

Attorney General Xavier Becerra (sponsor)

Consumer Attorneys of California

Consumer Federation of California

Consumer Reports

Consumer Watchdog

Media Alliance

Oakland Privacy

OPPOSITION

Advanced Medical Technology Association

Alliance of Automobile Manufacturers

American Advertising Federation

American Association of Advertising

Association of National Advertisers

CALASIAN Chamber of Commerce

California Association of Collectors

California Association of Licensed Investigators

California Bankers Association

California Business Properties Association

California Cable & Telecommunications Association

California Chamber of Commerce

California Communications Association

California Community Banking Network

California Credit Union League

California Fuels & Convenience Alliance

California Grocers Association

California Hospital Association

California Life Sciences Association

California Land Title Association

California Manufacturers & Technology Association

California Mortgage Bankers Association

California New Car Dealers Association

California News Publishers Association

California Restaurant Association

California Retailers Association

Card Coalition

Civil Justice Association of California

Cemetery and Mortuary Association of California

CompTIA

Connected Commerce Council

Consumer Data Industry Association

Consumer Technology Association

CTIA

Email Sender & Provider Coalition

Engine Advocacy

Entertainment Software Association

Global Automakers

Insights Association

Interactive Advertising Bureau

International Franchise Association

Internet Association

Internet Coalition

Investment Company Institute

Motion Picture Association of America

National Business Coalition on E-Commerce & Privacy

National Federation of Independent Business

National Payroll Reporting Consortium

NetChoice

Network Advertising Initiative

Plumbing Manufacturers International

San Diego Gas & Electric

Satellite Broadcasting and Communications Association

Securities Industry and Finance Markets Association

Southern California Gas Company

State Privacy & Security Coalition

Software & Information Industry Association

TechNet

The Toy Association

RELATED LEGISLATION

Pending:

SB 753 (Stern, 2019) provides that a business does not sell personal information if the business, pursuant to a written contract, shares, discloses, or otherwise communicates to another business or third party a unique identifier only to the extent necessary to serve or audit a specific advertisement to the consumer. The bill requires the contract to prohibit the other business or third party from sharing, selling, or otherwise communicating the information except as necessary to serve or audit advertisement from the business. This bill is currently in the Senate Rules Committee.

AB 25 (Chau, 2019) excludes from the definition of “consumer” in the CCPA a natural person whose personal information has been collected by a business in the course of a person acting as a job applicant or as an employee, contractor, or agent, on behalf of the business, to the extent their personal information is used for purposes compatible with the context of the person’s activities for the business as a job applicant, employee, contractor, or agent of the business. The bill states the intent to further clarify how a business shall comply with requests for specific pieces of information. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 288 (Cunningham, 2019) provides that when a user of a social networking service deactivates or deletes the user’s account, the service shall provide the user the option of having the user’s personally identifiable information permanently removed from any database controlled by the service, from the service’s records, and to prohibit the service from selling that information to, or exchanging that information with, a third party in the future. Consumers are authorized to bring civil actions for damages that occur as a result of violations of the bill, including attorney’s fees, pain and suffering, and punitive damages, as specified. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 846 (Burke, 2019) amends the non-discrimination provisions of the CCPA. It also removes the prohibition on businesses’ use of financial incentive practices that are unjust or unreasonable. It also clarifies that loyalty and rewards programs are not restricted by the CCPA. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 873 (Irwin, 2019) loosens the definition of “deidentified” and narrows the definition of “personal information” in the CCPA. It removes from the definition of “personal information” information that can identify a particular household. It also removes the requirement that a business reidentify or otherwise link certain information for purposes of the CCPA. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 874 (Irwin, 2019) amends the definition of “personal information” in the CCPA. It removes the application of the CCPA to publicly available information that is used for a purpose that is not compatible with the purpose for which the data is maintained and made available in government records or for which it is publicly maintained. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 950 (Levine, 2019) requires a business that conducts business in California and that collects a California resident’s consumer data to disclose to the consumer the monetary value to the business of their consumer data through various methods. If the data is sold, the business is required to disclose the average and actual price that is paid. The bill also establishes the Consumer Data Privacy Commission to provide guidance to the Legislature and to submit a report regarding appropriate metrics and methodology for determining the monetary value of consumer data. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 981 (Daly, 2019) exempts from the protections and provisions of the CCPA insurance institutions, agents, insurance-support organizations, or insurance transactions, as specified. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1138 (Gallagher, 2019) prohibits a person or business that conducts business in California, and that operates a social media website or application, from allowing a person under 16 years of age to create an account with the website or application unless the website or application obtains the consent of the person’s parent or guardian before creation of the account. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1146 (Berman, 2019) exempts from the protections and provisions of the CCPA vehicle information, including ownership information, shared between a new motor vehicle dealer and the vehicle’s manufacturer, if the vehicle information is shared pursuant to, or in anticipation of, a vehicle repair relating to warranty work or a recall, as specified. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1202 (Chau, 2019) requires data brokers to register with, and provide certain information to, the Attorney General. Such information must be made publicly accessible. This bill is currently in the Assembly Appropriations Committee.

AB 1355 (Chau, 2019) amends the definitions of “publicly available” and “personal information.” This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1395 (Cunningham, 2019) prohibits a smart speaker device, or a smart speaker device manufacturer, from saving or storing recordings of verbal commands or requests given to a smart speaker device, or verbal conversations heard by the smart speaker device, regardless of whether the smart speaker device was triggered using a key term or phrase. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1416 (Cooley, 2019) expands the exemptions within the CCPA, specifically including additional conduct that a business is able to engage in without restriction from the CCPA. This includes the ability to disclose personal information to assist another person to exercise legal claims and to protect against fraud or unauthorized transactions. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1564 (Berman, 2019) reduces the methods a business must make available to consumers for submitting requests for information required to be disclosed pursuant to the CCPA. It removes the requirement that a business provide a toll-free telephone number for such purposes. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1760 (Wicks, 2019) renames the CCPA the California Privacy for All Act of 2019 and strengthens various protections for consumers, including a change from opt-out consent for the sale of information to opt-in consent for the sharing of information. The bill also includes data minimization requirements and modifies various definitions. The bill expands the consumer enforcement mechanism within the CCPA, providing for a right of action for all violations of the CCPA and eliminating the right to cure. It also explicitly allows district attorneys, city attorneys, and county counsel to bring actions on behalf of the people for violations of the CCPA in addition to the Attorney General. It also removes the provision regarding the legal opinions of the Attorney General. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

Prior:

AB 375 (Chau, Ch. 55, Stats. 2018) See Comment #2.

SB 1121 (Dodd, Ch. 735, Stats. 2018) amended the CCPA to make technical fixes and to address various stakeholder concerns.

**************

1. Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1, 17, quoting the official ballot pamphlet for the Privacy Initiative. ↑

2. Civ. Code § 1798.1. ↑

3. Jacob Snow, Will California lawmakers vote to protect Californians’ privacy or tech industry profits? (March 27, 2019) ACLU, https://www.aclunc.org/blog/will-california-lawmakers-vote-protect-californians-privacy-or-tech-industry-profits [as of Apr. 6, 2019]. ↑