A new consumer data privacy initiative backed by the proponent of the measure that led to adoption of the state’s broad privacy law will likely appear on the November 2020 ballot.
The new privacy initiative, currently pending with the Attorney General’s office, is titled “The California Privacy Rights and Enforcement Act of 2020” (CPREA).
This privacy initiative was filed by the same proponent, Alastair Mactaggart, who filed the 2018 ballot initiative that ultimately led to the legislatively enacted California Consumer Privacy Act (CCPA), which goes into effect January 1, 2020.
Consumer Privacy Law
The CCPA is one of the most broad-reaching consumer data privacy laws in the country and generally provides consumers with the following rights:
• right to know what personal information a covered business is collecting or selling;
• right to request deletion of personal information;
• right to opt out of the sale of personal information; and
• right to be protected from discrimination for exercising any rights and protections under the CCPA.
The CCPA is generally enforced by the Attorney General’s office; however, enforcement is delayed until July 2020 when pending regulations will likely be in effect.
The CCPA includes a private right of action, but it is limited to data breaches for nonredacted, nonencrypted personal information. The private right of action takes effect on January 1, 2020.
Except for notice of the data being collected, the CCPA is not applicable to employee data or business-to-business data until January 1, 2021.
New Initiative
Beneficial Changes for Business
The CPREA expands upon the rights of consumers and burdens of business set forth in the CCPA, but also provides some beneficial changes. Some of the beneficial changes include:
• Raises the threshold for businesses that fall under the CCPA. Currently, the CCPA covers any business that: has an annual gross revenue in excess of $25 million—adjusted according to the consumer price index (CPI); derives 50% or more of its annual revenue from selling consumers’ personal information, or alone or in combination annually buys, receives, sells or shares for a commercial purpose the personal information of 50,000 or more consumers, households or devices.
The initiative raises this last threshold to 100,000 in an attempt to exempt small businesses from the CCPA’s onerous application.
• Delays the application of the CCPA to employee data or business-to-business data until January 1, 2023.
• Maintains legislative changes negotiated and signed into law in 2019 regarding definition of personal information, publicly available information, data pertaining to vehicle recalls, and limit on the scope of the privacy right of action.
• Provides a new state agency (discussed below) with authority to provide a business with a right to cure any alleged violation.
Expanded Consumer Rights/Business Burdens
Some of the most notable changes in the CPREA that will expand both consumer rights as well as burdens on business are:
• “Sharing” of data for advertising. Under the CCPA, a consumer has the right to opt out of the “sale” of personal information. The definition of “sale” under the CCPA is very broad and includes any disclosure, dissemination, transferring or otherwise communicating for valuable consideration.
Under the new initiative, a consumer can opt out of the “sharing” of personal information for purposes of targeted advertising by businesses. Sharing is basically defined as the transferring or disclosure of personal information, regardless of whether there is any monetary or other valuable consideration exchanged for the information.
This new term could expand the transactions businesses must consider for determining application of the CCPA/CPREA.
• New right to correct personal information. The pending initiative introduces a new right for consumers with regard to correcting personal information. Upon receipt of a verifiable consumer request, the business would have to use “commercially reasonable efforts” to correct inaccurate personal information.
This new right also increases burdens on businesses to evaluate the request being made, if it is the right consumer making the request, and the validity of the correction requested.
• Sensitive personal information. The pending initiative also includes a new term, “sensitive personal information,” and provides consumers with additional rights with regard to this information. The initiative defines sensitive personal information as personal information that reveals data such as a consumer’s Social Security number, driver license, passport, account log-in, precise geolocation, health data, sexual orientation, and other personal characteristics. A consumer has the right to direct a business that collects sensitive personal information to limit its use of the information to only that which is necessary to perform the services requested/expected by the consumer.
This new category of personal information will potentially increase burdens on business to evaluate the data collected, how it is used, and whether it falls within this new category of sensitive personal information.
• New state agency. The initiative creates the California Privacy Protection Agency, which will have the responsibility to enforce this expanded privacy law, assess penalties, provide guidance and develop regulations.
A new agency will create a new cost on the state General Fund and could prove challenging for the regulated community.
• Limits the ability to amend the law. The initiative includes a provision that restricts the Legislature from amending the law unless such amendments are consistent with and further the purpose and intent of the law. The challenge on this issue will be determining which amendments fulfill the purpose and intent of the law, and which do not.
Initiative Status
Mactaggart has said he filed the CPREA because of concerns about legislative efforts to reduce or limit the protections in the CCPA. Unlike the prior initiative that led to the CCPA, however, Mactaggart and supporter Senator Bob Hertzberg (D-Van Nuys) have said they are not planning to negotiate any legislative compromise on the new initiative to remove it from the ballot, meaning the CPREA initiative will likely be on the November 2020 ballot for voters to consider.
The CPREA has not yet received title and summary from the Attorney General’s office and therefore is not in the signature collection stage. However, there is still plenty of time for Mactaggart to gather the necessary signatures to qualify this measure for the November 2020 ballot.
