Sacramento is back in session, and there is one more month to get changes through the Legislature before the California Consumer Privacy Act goes into effect Jan. 1, 2020.
These are some of the issues I will be watching closely:
Who will win the battle over the definitions of 'personal information' and 'deidentified'?
Tech lobbyists suffered a major blow when AB 873, changing the definition of "deidentified," failed to pass out of the U.S. Senate Judiciary Committee. Assemblymember Jacqui Irwin, the bill’s proponent, was granted a motion of reconsideration, but a hearing date has not yet been set.
Will AB 873 pass out of committee in the next month, and if not, will Irwin attempt to make changes through other bills that already made it through the Judiciary?
If industry successfully pushes for significant changes to bills that already passed out of the Senate Judiciary Committee, will Sen. Hannah-Beth Jackson pull them back?
Jackson — the privacy advocacy coalition’s greatest advocate in Sacramento and the powerful chairwoman of the Judiciary Committee — issued some not-so-veiled threats during the July 9 hearing. Specifically, she cautioned Assemblymember Ed Chau, the original author of AB 375, the vehicle that created the California Consumer Privacy Act, not to play any tricks.
“I just want to close by saying that you have indicated all along that you want this to be a consensus bill," she said. "I appreciate that it is. I trust that the bill [AB 25] we are voting on today will not be amended to include additional items without consensus of all interested parties. I think this is a great place to stop, take a deep breath, and move forward as needed. And we all agree it is needed.”
Assemblymember Jacqui Irwin may be tempted to amend AB 874, a bill to narrow the definition of "publicly available," as it covers the same sections of the code as AB 873.
What will Jackson do?
Will retailers really be barred from selling personal information collected through loyalty card programs?
There was a rather tense exchange between Jackson and Assemblywoman Autumn Burke, the author of AB 846, during the hearing in July. Although Burke at first said she was not willing to take the committee’s amendments, she eventually relented and accepted the amendments including significantly, “(e) A business shall not sell the personal information of consumers collected as part of a loyalty, rewards, premium features, discounts, or club card program.”
This is a major win for privacy advocates, but I’m wondering if this amendment will survive.
Will Section 1798.125 — originally a strict non-discrimination provision — end up undermining the CCPA opt out of the sale of the information and turn privacy into a commodity that only the wealthy can afford?
As currently written, this is a major win for industry. Although this section states that a business cannot deny access or alter the quality of service if a consumer exercises any of their rights under the CCPA, the provision also says, “Nothing in this subdivision prohibits a business from charging a consumer a different price or rate, or from providing a different level or quality of goods or services to the consumer, if that difference is reasonably related to the value provided to the business by the consumer’s data. A business may also offer a different price, rate, level, or quality of goods or services to the consumer if that price or difference is directly related to the value provided to the business by the consumer’s data.”
How will this work in practice and will it effectively turn privacy into a commodity?
Status of stealth battles.
To date, industry has not been successful in eliminating “household” from the definition of "personal information," although they did try to change this in AB 874. If the definition of personal information is limited to “a consumer,” it would significantly limit the effectiveness of the CCPA.
For example, the law would no longer apply to devices that collect information about more than one consumer, including a smart speaker or a vehicle, even though these devices collect a significant amount of personal information and are becoming increasingly prevalent. I also remain surprised that there hasn’t been a stronger push to delay implementation or enforcement of the CCPA, especially given that it was industry’s first request last August.
CCPA — Save the date!
The Legislature reconvenes Aug. 12, and the Senate Appropriations Committee will hear many of these bills that day. Aug. 30 is the last day for the fiscal committees to meet and report bills. All committees must meet before Sept. 3, and Sept. 6 is the last day to amend on the floor. The legislature must pass any bills by Sept. 13, the last day of their session.
You can track the bills here.
But there are always "Sacramento shenanigans."
In April 2018 — early in our negotiations over a potential legislative compromise — we were worried that we did not have enough time due to the legislatively mandated deadline to pull the initiative.
Sen. Bob Hertzberg’s solution was simple: If need be, the legislature could “simply” change the law. In the murky business of politics, backroom deal making is always an issue. Amendments can be made at the last minute, rules can be changed, and seemingly unrelated bills can go through a process called “gut and amend.”
In fact, this was exactly how the CCPA originally passed into law. AB 375 was revived and amended from the inactive file June 21, 2018, amended again on the 25, and then, between the 25 and 28, it passed through several committees and administrative hurdles with the Senate graciously suspending a couple of rules along the way, to land on the governor’s desk on the 28, ahead of the June 29 deadline to pull the initiative.
Attorney General Xavier Becerra remains a wildcard.
When the attorney general’s office issues its preliminary rules this fall (you can monitor the status here), what will they look like? When will the final rules be issued? If they are issued before January, it will start the six-month clock to enforce the CCPA, and enforcement could begin ahead of the July 1, 2020, deadline. Also, how will the attorney general’s office respond if the Legislature claws back some of his responsibilities, including how a consumer submits a verifiable request.
What will Gov. Gavin Newsom do?
Even if these amendments pass out of the Legislature, they must still be signed by the governor. Oct. 13 is the final day for Newsom to sign any amendments.
The zombie apocalypse: It’s not over yet.
In California, the Legislative session in fact lasts two years. Thus, bills that have stalled in committee can come back to life when the session reconvenes next January.
Notably, however, the CCPA will be in effect, and it is much harder to take away rights once consumers exercise them. Also, with so many bills amending the CCPA that will likely pass, I’m left wondering, will there be a cleanup of the cleanup legislation?
Photo via Good Free Photos
