Last summer, California lawmakers unanimously passed a landmark data privacy law in response to growing concerns over how online companies are using people’s personal information.
Less than a year later, it’s clear that the sweeping law, which takes effect next year, marked more of a beginning than an end to the data privacy debate.
The California attorney general, who is tasked with implementing and enforcing the California Consumer Privacy Act, or CCPA, is still in the middle of soliciting public input on what regulations should look like. But in the meantime, more than a dozen California lawmakers have introduced over 40 bills this year that would build on the CCPA.
And outside the Golden State, eight other states are using the California law as a model for their own legislation; a ninth is using the European Union’s law as a blueprint. Nationally, there’s finally some action in Washington, D.C., where Congress has begun debating numerous bills, and the Trump administration is expected to come out with its own proposals in the coming weeks or months.
Meanwhile, private companies continue to try and get ahead of the problem: Facebook CEO Mark Zuckerberg announced plans this week to transform the social media company into a “privacy focused” platform.
“When the California privacy initiative went through the Legislature, there was a collective gasp here in Washington,” said Tim Lordan, executive director of the Internet Education Association, a nonprofit group that does not take policy positions. “It was like, ‘Oh my gosh, there’s no stopping this thing, how is this going to play out?’ It started dawning on people that this is happening.”
The California law came after years of inaction not just in Congress, but in Sacramento as well, where lawmakers were equally reticent to take on the complicated regulation of a huge, powerful player: the tech industry. California lawmakers’ were forced to the table after an even more sweeping initiative than the CCPA, authored by real estate developer Alastair Mactaggart, qualified for the November ballot.
After negotiating with Mactaggart and others, California came up with legislation that will allow state residents to ask large businesses what personal information has been collected by a company about them and let consumers tell the company to erase that information. If they don’t comply, the attorney general can take civil action.
Mactaggart, who heads a group called Californians for Consumer Privacy, said he’s glad the Legislature took up the issue because they can now easily tweak the law as public debate and technology progresses. A ballot can only be changed by another vote of the electorate.
“This is a fast-moving and complicated area,” he said. “I think we’re in good shape right now. There are a couple of cleanup items that do need to get addressed … and I’ve never been someone who said this is the last word, because we’re in an ongoing relationship between we the people and this new technology that’s come along.”
Lawmakers think there’s more to be done than Mactaggart, however. The new bills proposed in Sacramento run the gamut, from minor technical amendments to more sweeping changes. One would let consumers sue companies for violating the law. Another would require data brokers to register with the state.
And a package of four bills authored by a group of Republican assemblymen would tackle a number of hot-button issues. One bill would require social media companies to fully delete someone’s data when they close an account; another would require minors under the age of 16 to get consent from their parents before they create a social media account; a third would mandate that data breach victims are notified within 72 hours of a company discovering the breach; and a fourth would bar smart-speaker companies from storing or data mining voice recordings.
In California, at least, the issue is a squarely bipartisan one, said Assemblyman Jordan Cunningham, R-San Luis Obispo.
“When I talk to my constituents about it, they are overwhelmingly supportive of the notion of individual privacy and the importance of passing laws that make sure that the individual consumer doesn’t get lost in this rush to new technologies,” he said. “I think the CCPA was a great step. I think it’s been widely hailed as the strongest digital privacy law in the country. And I think that’s right. But I think we need action in a couple other areas.”
But business groups like the Internet Association — a national tech lobbying group — argue that expanding the law before next year is premature. Robert Callahan, vice president of state government affairs at the Internet Association, said the CCPA was rushed through the Legislature last year with the understanding that some tweaks should be made before it takes effect in 2020 — but just tweaks.
“A number of those bills are looking to drastically alter the operation of CCPA before the law even goes into effect. They’d really alter the fundamentals of the laws,” he said. “Frankly I would say those efforts are a bit of a distraction to really what California’s primary focus needs to be, which is getting the current law on the books done right before it goes into effect next year.”
Meanwhile, tech companies would still prefer to see a national law instead of a patchwork of state rules. Terrell McSweeny, a former commissioner with the Federal Trade Commission, said one of the big issues now being debated in Washington, D.C. is whether anything passed by Congress would pre-empt state laws — something California leaders vehemently oppose.
“That is an area that’s going to be hotly debated,” McSweeny said. “On the one hand, proponents of pre-emption point to the fact that having one framework would make it easier for everybody and would make it easier for consumers to also understand what their rights are and potentially reduce burdens. … And on the other hand, folks (are worried that) what might be agreed to at the federal level would reduce protections for citizens of certain states.”
Californians involved in the discussions, including Mactaggart, said they are hopeful that California’s sizable House delegation will fight any efforts to override the state’s groundbreaking law.
To learn more about how we use your information, please read our privacy policy.