While many companies are struggling to make sense of the California Consumer Privacy Act (“CCPA”) (see our prior posts here and here) and roll out their CCPA compliance programs, the California Assembly Privacy and Consumer Protection Committee (“Privacy Committee”) and the Senate Judiciary Committee have advanced a number of bills that would amend various aspects of the CCPA. The industry-backed bills that advanced out of the Committees aim to revise certain definitions (e.g., of “consumer” and “personal information”) and give businesses greater flexibility, while those backed by consumer groups seek to expand the CCPA’s enforcement mechanisms and require greater transparency about the value of consumer information. While most bills were approved by the Committees, it is notable that two of the most controversial proposals—one modifying the definition of “sale” and one replacing the opt-out right with an opt-in right—were pulled from consideration before the hearings.
It’s not entirely clear which of these bills will ultimately pass and, if they pass, in what form. But an understanding of the issues under consideration in each bill is helpful as companies decide how to prioritize compliance efforts ahead of the January 1, 2020 compliance deadline.
Industry-Backed Bills
- AB 25: This bill would exclude employees, job applicants, contractors, and agents from the definition of “consumer,” to the extent their personal information (“PI”) is used for purposes compatible with the context of that person’s role in the business. The bill was passed out of Committee without opposition, and may now be further amended to incorporate other consensus proposals that were deleted from other bills during the amendment process, such as removing “households” from the definition of PI.
- AB 873: While this bill originally made significant changes to the definitions of “PI” and “deidentified,” opposition from consumer advocates resulted in a more modest compromise measure being passed out of Committee. Nevertheless, the revised bill would make a number of helpful changes to the PI definition, including:
- Clarifying that information qualifies as PI only if it “reasonably is capable of being associated” with a consumer;
- Revising the definition of “deidentified”; and
- Revising the current exception to CCPA compliance for data that is not maintained in “a manner that would be considered personal information” to “data that is not maintained as personal information.”
- AB 874 and AB 1355: These bills would clarify that PI excludes deidentified or aggregate consumer information, similar to AB 873 above. AB 874 would also clarify that any PI lawfully made available from government records is “publicly available” and thus also excluded from the definition of PI.
- SB 753: The sponsor of this online advertising bill pulled it from consideration before the Privacy Committee hearing. It would have added a specific exception to the definition of “sale” for the sharing of certain types of online identifiers (e.g., IP address and cookie identifier) for purposes of online advertising. The measure failed after facing opposition not only from consumer advocacy groups, which touted the negative impacts of creating a loophole for advertisers, but also from some industry groups, which felt that the bill increased regulatory risks for advertisers that shared other identifiers not covered by the amendment.
- AB 1564: This bill would give businesses more flexibility in providing methods through which consumers can make requests by requiring that businesses make available a toll-free phone number oremail address to receive such requests.
Consumer Advocate and Government-Backed Bills
- SB 561: As currently drafted, this bill would expand the private right of action (“PRA”) to apply to all provisions of the CCPA, remove the 30-day right to cure violations, and eliminate the requirement that the Attorney General provide guidance to businesses. While the Senate Judiciary Committee approved the bill, committee members expressed strong reservations about the expanded PRA and recommended that the sponsor amend the bill to provide an alternate, more limited way of bolstering enforcement. We understand one such alternative would be allowing local city/county attorneys to enforce the CCPA.
- AB 1760: This sweeping proposal to greatly expand the CCPA was pulled from consideration before the Privacy Committee hearing. It would have changed the right to opt-out of the sale of PI to a right to opt-in to any sharing of PI and would have prohibited any discrimination based on a consumer’s exercise of his/her rights.
Industry-Specific Bills
In addition to the above, two bills targeting issues relating to certain industries (retail and automotive) advanced out of the Privacy Committee.
- AB 846: This bill would amend the CCPA’s anti-discrimination provision to allow businesses to offer consumers incentive programs like loyalty and rewards programs, discounts, and gift certificates and gift cards.
- AB 1146: This bill would refine the exception for deleting vehicle information by citing the California law defining “vehicle manufacturer”.
