Shooting at a Moving Target: The Continuing Saga of Possible CCPA Amendments

Six bills proposing various changes to the California Consumer Privacy Act (CCPA) continue to move through the state’s legislature, and are likely to come up for a final floor vote imminently. None of the proposed amendments would change the law’s core requirements. However, some would clarify ambiguities and reduce certain compliance burdens.

Where the Amendments Stand

The following six bills passed the Assembly and are working their way through the Senate:

• AB-25, exempting – for one year – employee data from CCPA requirements related to access, deletion and opt-out, but not transparency;
• AB-846, clarifying that discounts and differences in services associated with loyalty programs are permitted under the law, but prohibiting the sale of data collected through loyalty programs;
• AB-874, refining what publicly available information is excluded from the definition of personal information;
• AB-1146, allowing sharing of information between a motor vehicle dealer and manufacturer without opt-out rights and clarifying that the right to deletion does not apply to data necessary to conduct product recalls;
• AB-1355, making a number of technical corrections in the law; and
• AB-1564, eliminating the requirement to operate a toll-free phone number to accept consumer requests in certain circumstances.

For more details about the content of these bills, please refer to our articles about them in the Privacy Oracle’s April and June issues.

CCPA Bills See Little Opposition in State Senate

Most of these bills have not faced significant opposition from California senators or privacy advocacy groups. Each one passed unanimously out of California Senate committees with relatively minor amendments, if any. AB-846, which relates to company loyalty programs, was one of the few that the California Senate meaningfully amended.

As passed by the California Assembly and the CCPA’s nondiscrimination requirement notwithstanding, the bill would have clarified that stores could offer discounts as part of loyalty programs in which consumers voluntarily participate. However, after significant pushback at a July 9 hearing, the California Senate Judiciary Committee amended the bill by slightly narrowing the situations in which loyalty programs are permitted and adding a prohibition on selling any personal information collected as part of a loyalty program.

The Senate also amended AB-25, the bill regarding employee data, by moving the operative language to a different part of the bill and sunsetting the access, deletion, and opt-out exemption after just one year.

Deadline for Final Vote Looms

While the momentum of the bills suggests they have a relatively good chance of becoming law, there are of course no guarantees in the legislative process—as dramatically exemplified by the sudden and unexpected demise of the Washington Privacy Act earlier this year after privacy advocates refused to support the more moderate version that emerged as the legislative vehicle. The CCPA amendments are at risk of similar derailment because even if the California Senate passes them, they will need to go back to the California Assembly for approval.

All of the CCPA amendments fall into this category except AB-1355 and AB-874, which thus far have been subject only to technical changes (although there is still a chance that they will be amended before final passage by the California Senate).

Even if members of the California Assembly do not object to the California Senate’s amendments to the bills, getting the legislation across the finish line by September 13—the final deadline for the legislature to send bills to the Governor—may still be a procedural challenge.