With only a week until what might be the most important U.S. election in a generation, tensions across the United States are running high. True, the big focus for the nation is on the presidential election, while a selection of closely contested and equally significant U.S. Senate races also hang in the balance.
But for the privacy profession, there's a major election choice in California this Nov. 3.
Proposition 24, the ballot initiative that would cement the California Privacy Rights Act into law, will be decided next week. And so far, things are looking up for those who support the initiative. According to polling in early October from Californians for Consumer Privacy — the organization that initiated Proposition 24 — 77% of state residents support the CPRA.
Yet, across the state, the battle lines for and against the initiative are not what you might assume.
In fact, the CPRA, which would place additional consumer privacy requirements on companies doing business with California residents, doesn't have the support of some of the major consumer and digital advocacy organizations in the country.
The biggest opponent is the American Civil Liberties Union of Northern California. In a recent blog post, Jacob Snow and Chris Conley wrote Proposition 24 "will undermine protections in current law and increase the burden on people to protect themselves — in ways that will disproportionately harm poor people and people of color." The organization also argues the CPRA places a greater burden on individuals by forcing those who want to opt out of having their data sold or shared to opt out of potentially dozens or even hundreds of companies.
Front and center for the ACLU is that Prop. 24 will not protect the state's most vulnerable populations. Specifically, it "threatens to make privacy a luxury available only for the most privileged Californians. ... [and] places the burden of privacy on the individual, a load those in working families and marginalized communities cannot bear."
The Electronic Frontier Foundation has similar concerns with Prop. 24 but doesn't go as far as the ACLU in opposing the initiative. Similarly, last July, Consumer Reports shared a Privacy Perspectives post with the IAPP in which it supported some of the short-term effects of the CPRA while questioning some of its long-term impacts.
Last Friday, however, Consumer Reports changed course and announced it now fully supports Prop. 24. CR's Justin Brookman said Prop. 24 would close "the worst loopholes in the CCPA, to help make the new law more workable for consumers."
In a podcast with the IAPP, Alastair Mactaggart, one of the driving forces behind both the California Consumer Privacy Act and Prop. 24, said, "You could have knocked me down with a feather when I heard the ACLU took this position." Almost exasperated, he said, "We literally do the opposite" of what they're saying, noting Prop. 24 now has the support of groups such as Consumer Watchdog, Common Sense Media and the National Association for the Advancement of Colored People.
Listen to Alastair Mactaggart discuss Prop 24 with Jedidiah Bracy.
Other big names have come out in support of Prop. 24, as well, including former presidential candidate and tech mogul Andrew Yang, Rep. Ro Khanna, D-Calif., privacy scholar Chris Hoofnagle and author Shoshana Zubhoff.
Several large California newspapers also support Prop. 24, including the Los Angeles Times and Sacramento Bee. The Times claims, "It's not perfect, but would improve privacy online," while the Bee writes, "Prop. 24 will strengthen online privacy protections for Californians. Vote yes."
But not all major California newspapers agree. The San Jose Mercury News tells readers, "Reject Prop. 24," saying the state needs more time to evaluate and use the legislative process before going to voters.
A big swath of industry agrees. In an open letter, a broad coalition of trade organizations — including the Network Advertising Initiative, Interactive Advertising Bureau, NetChoice and Digital Advertising Alliance — do not support Prop. 24. The coalition claims the measure "is premature and [an] ill-timed overhaul of California's privacy law." They point out that the CPRA went on the ballot before the California attorney general finalized its implementing regulations for the CCPA.
Additionally, one of the CCPA's co-architects, Mary Stone Ross, also does not support the CPRA.
In terms of timing of the CPRA right on the heels of the CCPA, Mactaggart would point out that the CPRA, if passed, would not go into effect until 2023, giving businesses time to up their compliance posture.
Yet, some immersed in the debate do not think that now is the time for a new state privacy law.
Santa Clara University's Eric Goldman is a vocal opponent to the CPRA, writing an op-ed for the San Fransisco Chronicle and a deeper criticism of it on his website. He has also gathered together a host of practitioners and other individuals in collective opposition to Prop. 24. Notably, Goldman expressed a procedural objection to the CPRA, saying it "functionally codifies the CCPA before we know how it works," adding "it reminds me of the Darth Vader deal in Cloud City."
One controversial provision within the CPRA is designed to set a floor for privacy protections in the law so that the industry cannot chip away at it over time through lobbying. Mactaggart worries that if Prop. 24 is not passed, the CCPA as it exists will eventually be fully gutted by industry. "In the face of business opposition, I don't think legislation is a strong enough moat around the law, even with regard to privacy," he said.
But Goldman is concerned the provision — because it has a section on future amendments must also consider business interests — will calcify under legal wrangling. "The amendment mechanism in the CPRA is defective and not going to work," he said. "The Legislature is not going to touch the CPRA," he warned. "Somebody, possibly both sides, would challenge any changes in court (whether it's pro-privacy or pro-business interests). The Legislature doesn't need that headache."
In responding to general criticism that the business interest provision would actually run counter to the spirit of the privacy protection within the law, Mactaggart brought on Berkeley Law Professor David Carrillo, an expert in the California State Constitution, in a pro bono capacity. Mactaggart said Carrillo found the changes in the CPRA would be a "one-way ratchet" and that there's "a ton of jurisprudence in California around the primacy of the initiative process."
Legislative procedural issues aside, some privacy practitioners are concerned about the cost the CPRA will have on business, particularly small- and medium-sized companies. In a phone interview, Tanya Forsheit, CIPP/E, CIPT, PLS, who was speaking on her own behalf and not that of any specific clients, said she thinks the additional layer of compliance costs required of companies will ultimately hit consumers' wallets.
She said companies have spent the last year implementing measures for data subjects rights, updating contracts and so forth. These measures cost money, so ultimately, that will raise the price of products and services. And that's for the companies that decide to comply with the CPRA. Due to the pandemic, for example, many businesses are already laying off employees while cutting budgets, making it even more difficult to direct resources to CPRA compliance. This could lead to noncompliance, which isn't good for consumers, she said.
Forsheit also argues the CPRA has complicated parts of the CCPA, particularly the "contractual structure." She said a whole new category has been added to the current triumvirate of "business," "service provider" and "third party." To that, the CPRA adds "contractor." She questions the addition of the fourth "contractor" category and is concerned it serves very specific, but opaque, corporate interests. This, again, she said, isn't good for consumers.
For small companies in California, Mactaggart said the CPRA "dramatically reduces the scope with regard to small businesses." He noted there was confusing language in the CCPA involving the "sale" of data for commercial purposes and that the CPRA clarifies these clauses. "If you're a small contractor, you're not going to be covered, unless you're selling personal information," he said.
An additional change brought by the CPRA involves enforcement. The CPRA would create a new agency dedicated to privacy enforcement in the state. Mactaggart said the agency would become the "most powerful privacy regulator in the country — and importantly, the most effective." He said it won't just enforce the law, but would also provide guidance and advice for businesses. Moreover, the CPRA would allow all of California's 58 counties and four major cities to enforce the law, as well.
Yet, Goldman thinks a new specialized agency will effectively turn into a "kangaroo court." He said "it's likely to take on a normative view that doesn't incorporate the kind of balances needed in privacy," that it won't have the pragmatic tradeoffs needed between privacy and business interests.
For Mactaggart, the CPRA is part of a "journey" that ultimately could lead, if approved, to other states adopting laws of their own or omnibus federal privacy legislation. "California was the first state to pass a data breach law," he said. "Now, all 50 states have a data breach law." The influence on big business could also have a positive effect. He points to the decision to extend CCPA rights across the U.S. by Microsoft and Apple as good examples of this.
Ultimately, whether Californians vote yes or no on Prop. 24 next week, the outcome will have a profound effect on domestic privacy legislation and for privacy practitioners on the ground.
Photo by Viviana Rishe on Unsplash
