A Barrage of CCPA Amendments: Can Any Go the Distance?
After months of sparring among politicians, businesses, and privacy advocates, both the California Assembly and Senate have advanced a variety of proposed amendments to the state’s first-in-kind comprehensive privacy statute, the California Consumer Privacy Act or CCPA. But the clearest thing to emerge from this rush to “clarify” CCPA is the multitude of concerns that the statute has raised on each side of the debate.
The majority of bills approved by the Privacy and Consumer Protection Committee of the Assembly (“the Committee”) appear aimed at narrowing the amount and types of data that are subject to CCPA restrictions. For example, California businesses long have asserted that the CCPA should not apply to data collected by employers about their employees and job applicants. AB 25 would amend the CCPA to eliminate the statute’s potential application to data collected in the employment context. Similarly, two amendments advanced by the Committee (AB 874 and AB 1355) would exclude deidentified or aggregated data from the definition of “personal information.” Another (AB 873) would narrow the definition of personal information further by eliminating the statute’s application to information that identifies only a household, rather than an individual. AB 1146 would exempt vehicle information shared between a motor vehicle dealer and a manufacturer.
One amendment that advanced in the Senate earlier this month would result in a significant change to the enforcement of the law. SB 561, scheduled for a hearing on April 29, 2019, would expand the CCPA’s private right of action to apply to any violation of the statute and eliminate the 30-day period that would allow businesses to cure a violation prior to a plaintiff initiating suit. Far from the narrowing and clarifying measures moving in the Assembly, this Senate initiative would expand exponentially the impact and costs of CCPA compliance for California businesses by allowing class action litigators to drive the interpretation and enforcement of the CCPA at will.
Do not be misled, however—there is no universal agreement in Sacramento that the CCPA must be tamed. Even if all of the Committee’s amendments were to be approved by the full California Legislature, the chances that any of these measures will be approved by the Senate is far from certain.
CCPA Amendments Summary:
Assembly Bills
AB 25: Clarifies that the term “consumer” does not include “a natural person whose personal information has been collected by a business in the course of a person acting as a job applicant to, an employee of, a contractor of, or an agent on behalf of, the business” to the extent that person’s information is collected and used “solely within the context of the person’s role.”
AB 846: Confirms that a “consumer’s voluntary participation” in a loyalty or rewards program is permitted under the statute
AB 873: Amends the definition of “deidentified” to mean information that “does not reasonably identify or link, directly or indirectly, to a particular consumer.” Also amends the definition of “Personal information” to mean “information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular consumer” and eliminates reference to information that identifies a household.
AB 874: Amends the definition of “personal information” to exclude deidentified or aggregated consumer data and amends the definition of “publicly available information” to mean information lawfully provided from federal, state, or local government records.
AB 1355: Requires that a business disclose “[t]hat a consumer has the right to request the specific pieces of personal information that the business has collected about that consumer.” Also provides that businesses may disclose the personal information sold to third parties by listing the category of third party, rather than by identifying each third party. Similar to AB 874, amends the definition of “personal information” to exclude deidentified or aggregated consumer information. Requirement that financial incentives and price differentials be reasonably related to the value provided to the business by the consumer’s data, rather than the value provided to the consumer by the consumer’s data.
AB 1146: Exempts vehicle information shared between a new motor vehicle dealer and the vehicle’s manufacturer from the statute.
AB 1564: Allows businesses to provide an email address rather than a toll-free number for CCPA requests.
Senate Bills
SB 561: Expands the CCPA private right of action to include any violation of the statute and removes the 30-day cure period prior to filing suit.