Assembly Committee Holds Hearing on Privacy Act
Thursday, February 21, 2019
California Chamber of Commerce Policy Advocate Sarah Boot addressed the Assembly Privacy and Consumer Protection Committee at an informational hearing to discuss the rights, protections and obligations established by the California Consumer Privacy Act (CCPA).
California Consumer Privacy Act
The CCPA is a sweeping privacy law that applies to businesses of all sizes across almost every industry. It was rushed through the legislative process in the summer of 2018 without the benefit of input from numerous crucial stakeholders. As a result, the law is deeply flawed. Many of the CCPA’s provisions are simply unworkable in practice or will result in numerous unintended consequences. At the end of the 2018 session, the Governor signed SB 1121, a bill fixing a handful of the CCPA’s problems. However, many more fixes are needed before this law goes into effect on Jan. 1, 2020.
Who Has Rights Under CCPA?
The CCPA defines a “consumer” as “a natural person who is a California resident.” Thus, a “consumer” need not have a customer relationship with a business in order to exercise rights under the CCPA.
What Rights Did CCPA Create?
The CCPA provides consumers with the following privacy rights to be enforced by the Attorney General:
- The right to know the categories of personal information a business has collected about them and how.
- The right to access their personal information.
- The right to opt out of a business’ sale of their personal information.
- The right to request that a business delete their personal information.
- The right to not be treated differently by a business for exercising their rights under the CCPA.
The CCPA also creates a private right of action that massively expands the liability of a business that has been the victim of a data breach. With this private right of action, a consumer does not need to prove any injury and can recover minimum statutory damages of $100 per person, per incident, and a maximum of $750. This unchecked liability will lead to a barrage of shakedown lawsuits, as companies facing such substantial liability will be leveraged into immediate settlement, regardless of the strength of their legal defense.
While the CalChamber appreciates and understands the need and desire for consumer privacy, the CCPA unfortunately has multiple flaws that undermine consumer privacy as well as employee protections. The benefit of the CCPA, as opposed to the withdrawn 2018 initiative that the CCPA was passed to replace, is that the Legislature has time to address these flaws before the entire law goes into effect.
California has the opportunity to lead the country on this issue and produce model legislation on consumer privacy that works for both consumers and businesses. CalChamber will continue to push for crucial legislative changes to fix the CCPA in 2019, and also will be involved in the Attorney General’s rulemaking process to ensure that business efforts to implement and comply with the CCPA can be as efficient and safe as possible.