"Copycat CCPA" Bills Introduced in States Across Country

Privacy has been a hot topic for state legislatures in the first month of the year. Legislators in nine states have introduced draft bills that would impose broad obligations on businesses to provide consumers with transparency and control of personal data. If passed, these laws will impact nearly any type of entity that operates in the state, even if the business has no physical presence in the state. Though the California Consumer Privacy Act (CCPA)—which was passed in the course of a week with little legislative debate—has been criticized for containing provisions that are inoperable, legislators in other states have embraced both the structure and specific language of that law.

Of the nine states, six follow the full model established in the CCPA, and two approach only certain issues addressed by the CCPA. The ninth state is Washington, which is debating a privacy bill modeled after the GDPR (our analysis of the Washington Privacy Act is available here).  A tenth state, New Jersey has a draft privacy bill that was introduced last July but has not moved out of committee.

Draft State Laws, In a Nutshell

Hawaii (SB 418): The Hawaii bill has a potentially broader reach than the CCPA because it does not define a business, thus extending applicability to all businesses operating in Hawaii. The bill, oddly, does not specify any penalties for violation and does not include a private right of action.

Maryland (SB0613): Though the consumer rights offered in Maryland’s draft bill are the same as those in the CCPA, there are some notable differences in execution.  The deletion right is expansive, allowing consumers to demand deletion of any personal data a covered entity maintains, whereas other states merely allow consumers to demand deletion of data only they have provided; there are also no broad exceptions for a business’s internal use reasonably expected by consumers. The draft Maryland bill does not address data belonging to minors and does not create a private right of action.

Massachusetts (SD 341): Massachusetts’s draft law copies the CCPA, but unlike several other states, rewrites several provisions that were duplicative or vague by using clearer language. The substantive requirements are largely the same; however, Massachusetts has fewer exceptions regarding when a covered entity can refuse to delete data, and prohibits any discrimination or financial incentives where consumers have exercised their rights under the law, including the right to opt-out. Massachusetts would also allow private lawsuits to be brought for any violation of the law.

Mississippi (HB 2153): Mississippi’s draft bill hews so closely to the CCPA that it copies the duplicative statements of access rights and similarly fragments the notice requirements. The enumerated categories of data that constitute personal information are slightly different (for example, probabilistic identifiers are missing). And, the private right of action is not limited to data covered by the breach notification law (which is a separate category of more sensitive data)—any unauthorized access of any personal information could give rise to a lawsuit. Mississippi’s bill died in Committee on February 5, 2019, but we have included it for comparison purposes.

New Mexico (SB 176): Sen. Michael Padilla, D-Albuquerque, the bill’s sponsor, is quoted as saying that in drafting the New Mexico’s Consumer Information Privacy Act, “I tried to throw as much spaghetti on the wall” as possible. Padilla’s spaghetti looks a lot like the CCPA, though more clearly structured. The bill also contemplates a significant rulemaking by the NM Attorney General starting in July 1, 2019, with regulations to be promulgated within a year and updated annually.

New York (S00224): New York’s bill is more like California’s Shine the Light Law, which requires transparency regarding the disclosure of personal data to third parties for marketing purposes, although its obligations are much more onerous. The New York Consumer Privacy Act of 2019 would require covered entities to provide a customer with notice of the categories of information shared with third parties and the names and contact information of all third parties with whom data is shared “prior to or immediately following a disclosure.” Service providers (contracted to perform functions for the business, such as data storage and hosting)) are exempted from the definition of third parties. Consumers would also have the right to access specific pieces of information held by the covered entity.

North Dakota (HB 1485): North Dakota’s minimalist bill contains only one substantive requirement: covered entities are prohibited from disclosing an individual’s personal information to anyone other than the individual without the “express written consent” of the individual. To obtain consent, the entity must send a brief, one to two page summary of its privacy practices to the individual by “mail or electronic mail” and receive an affirmative response. While the other states’ draft bills account for a category of third parties who receive data in the context of providing a service to the primary covered entity, the North Dakota law would not allow for sharing with service providers without this consent.

Rhode Island (S0234): The Rhode Island Consumer Privacy Act of 2019 also takes its inspiration from the CCPA, including listing the access right three times. One notable difference, however, is that the bill does not contemplate a role for the state Attorney General, either in rulemaking or enforcement. Thus, provisions that have been criticized as unclear or inoperable in the CCPA, such as what constitutes a verifiable consumer request and the restriction on differentiation in services where consumers have exercised rights unless “reasonably related to the value provided to the consumer,” would not receive further elucidation.

What Trends are Emerging?

Washington is the outlier in modeling its bill after GDPR rather than CCPA (our analysis of the Washington Privacy Act is available here). Most other states are copying CCPA—in the case of Mississippi, almost verbatim. Only New York and North Dakota fail to follow the structure of CCPA, but incorporate much of the same wording. This widespread adoption of the CCPA language means that a number of concepts are now emerging as the potential norm in privacy policy:

• The focus of the laws is on consumer rights, not organizational practices. The GDPR concepts of lawful basis for  processing, data minimization, and privacy-by-design—which would provide more comprehensive privacy benefits across all consumers—have not caught on in the US, even in Washington which models its law after the GDPR.
• Consumers have broad rights to demand access to specific pieces of information about themselves “upon verifiable request”; however, what constitutes a verifiable request is not defined. The draft laws also give consumers the right to demand deletion of data they have provided to businesses in certain circumstances, and to opt out of disclosures to third parties, other than service providers.
• The definition of consumer information is greatly expanded. Though the wording varies slightly from state to state, personal information now is generally thought to include any information that identifies or reasonably could identify a person. This construction sweeps in biometric information, unique identifiers besides a name, Internet activity, audio recordings, and inferences about an individual’s likely preferences.
• Employee and business contact data is considered personal data, even though the risks related to processing and disclosure of employee and business contact data are drastically different from consumer risks.
• Even businesses that only collect information via the Internet must designate multiple methods for consumers to submit requests, including a toll-free number. A “Do Not Sell My Personal Information” hyperlink is required on company websites.

None of the copycat CCPA state laws tackles issues related to artificial intelligence, unlike the WPA which follows the GDPR in merging potential discrimination risks associated with automated processing with other privacy risks.

Key Points of Variation

Though a majority of the new laws copy the structure of the CCPA, there are some notable places where they diverge, further complicating prospective compliance efforts. The most critical area is enforcement. CCPA provides a private right of action only for the unauthorized disclosure of unencrypted, sensitive data.  Massachusetts would extend the private right of action to any violation of its privacy law. Three of the state laws (Mississippi, New Mexico, and Rhode Island) extend a private right of action to any unauthorized disclosure of personal information, regardless of sensitivity of the data and potential risk to consumer.

Similarly, while all these new state laws protect consumer privacy, the degree of specificity and format requirements vary, which will likely increase criticisms that privacy policies are written in legalese and too difficult to understand. All these draft laws require disclosure of the specific rights available to consumers. Two states (Hawaii and New Mexico) require disclosures regarding data collected and shared to be matched against certain enumerated categories of the statute, which differ in each law. And Hawaii names the opt-out link “Do Not Sell My Identifying Information” as opposed to Personal Information. The result is that businesses may have to implement multiple layers of protection in privacy policies for consumers in different states, even when the underlying data practices are the same nationally.

Hawaii, Maryland, Massachusetts, and Mississippi

For a PDF version of this chart, click here.

New Mexico, New York, North Dakota, and Rhode Island

For a PDF version of this chart, click here.