While most of the nation anxiously awaits the final vote tallies for the U.S. presidential election, several privacy-related propositions and referendums were also on the ballots in a few states. Most significantly, California's Proposition 24 has passed, according to The San Fransisco Chronicle.
As of 10:15 a.m. EST, The Associated Press reveals that, with 72% of precincts reporting, California Proposition 24 has garnered 56.1% yes (6,342,807 votes for) and 43.9% no (4,966,086 against). Approval of Prop. 24 means the California Consumer Privacy Act will be amended to the California Privacy Rights Act, which includes the establishment of a new privacy enforcement agency, new definitions for sensitive data with limits on use and sharing, and expanded breach liability.
Though the CPRA will not enter into force until January 2023, it will have a "look back" to January 2022. According to Orrick's Cyber, Privacy & Data Innovation blog, the California Constitution states ballot initiatives "approved by a statewide general election take effect the fifth day after the Secretary of State certifies the election results" and "On the fifth day after certification," five provisions of the CPRA become law.
The five provisions include extensions of the employee exception and business-to-business exception to Jan. 1, 2023; the establishment of a Consumer Privacy Fund; direction for the California attorney general "to adopt regulations and the mechanisms to transfer regulatory authority" to the state's new enforcement agency, the California Privacy Protection Agency; creation of the CPPA, "vested with full administrative power, authority and jurisdiction to implement and enforce the CCPA, as amended by the CPRA"; and designation of funds for the CPPA, which are expected to be approximately $10 million.
With approval of Prop. 24, a new and major privacy law will go on the books, meaning privacy professionals working for companies that do business with California residents need to pay attention. Hintze Law Managing Partner Susan Hintze, CIPP/US, CIPT, FIP, offered some first-step advice: "First thing I would do as a privacy pro is educate leadership about the increased risks and request more funding."
Covington Burling's Lindsey Tonsager pointed out "Privacy pros should be reminding their colleagues that even though we now know the CPRA has passed, many of the CPRA’s details still need to be clarified and defined through regulation."
Establishment of the new enforcement agency will also be worth paying attention to. Tonsager said it's a "key thing to watch." She added, "This newly constituted agency will be conducting another round of rulemaking to clarify a number of key areas, including defining the difference between 'service providers' and 'contractors' (which is a new regulated entity under the CPRA)."
Tonsager added, "How the (CPRA) will be interpreted and enforced will depend significantly on who makes up the five-member board of the new (CPPA). Two of these seats (including the chair) will be appointed by the governor, and each of the remaining seats is appointed by the attorney general, Senate Rules Committee, and Speaker of the Assembly, respectively. These positions should be filled in about 90 days."
Hintze was similar in her emphasis on the upcoming enforcement authority, suggesting the "new well-funded (CPPA) really increases the stakes."
Consumer Reports' Maureen Mahoney, who contributed a Privacy Perspectives post with the IAPP last July, applauded passage of Prop. 24 but said, "the fight isn't over. We will continue to work with policymakers to lock in even stronger privacy protections, to ensure that privacy is guaranteed by default and that consumers are able to exercise their privacy rights free of charge." CR changed course in recent weeks after not supporting Prop. 24, but in October, the consumer advocacy organization gave the initiative its full support.
In response to the election news, Alastair Mactaggart — one of the driving forces behind the CCPA and Prop. 24 — said he's "looking forward to the work ahead and the next steps in implementing this law, including setting up a commission that is dedicated to protecting consumers online."
Prop. 24 faced an array of opposition, most notably from the American Civil Liberties Union of Northern California and the advertising technology industry. In an open letter, a coalition of trade organizations in opposition to Prop. 24 said the measure "is premature and [an] ill-timed overhaul of California's privacy law."
In a recent IAPP article, Frankfurt Kurnit Klein & Selz's Tanya Forsheit, CIPP/US, CIPT, PLS, said the CPRA, coming on the heels of the CCPA, will burden businesses — particularly small- and medium-sized organizations — by imposing a new regime of privacy requirements and that the cost of compliance will ultimately be passed on to the consumer. This comes at a time, she said, when companies are struggling with their response to the COVID-19 pandemic.
Listen to Alastair Mactaggart discuss Prop. 24 with host Jedidiah Bracy.
In a lengthy podcast interview, Mactaggart countered criticism of Prop. 24, from the advocacy, practitioner and industry sides. But Mactaggart was also, now correctly, optimistic that the initiative would ultimately pass. He believes the CPRA will have broader effects on privacy law in the U.S. and abroad, including his belief that it could eventually lead to an adequacy determination from the European Commission. But that's a long way off.
In the U.S., the CPRA could have an influence on other state privacy laws, including the proposed Washington Privacy Act.
Hintze, who is based in Washington state, pointed out "both CPRA and the Washington bill are more in line with (EU General Data Protection Regulation). I predict this trend to continue and will shape what other state laws look like and perhaps a federal privacy law."
As a potentially significant side note for the future of Washington's privacy law, Hintze said that an "obstacle to passage of the Washington bill may have been removed. One of its key critics in the house, Zack Hudgins, chair of the House Innovation, Technology and Economic Development committee, was defeated in the election. Some speculate this will increase chance of the Washington bill passing next session."
The future course of a federal privacy law is tough to predict at the moment, especially as the nation grapples with who will be the next president. Hintze tempers expectations of a federal bill, for now: "Survival of a privacy bill through the federal process is still challenging. And we will see a continued, if not increased engagement level by the type of political action committees that emerged in the CPRA ballot initiative that may make it even more challenging to reach consensus at the federal level."
In the meantime, there's plenty of work ahead in California.
Photo by Wil Stewart on Unsplash
