Fixing the California Privacy Law Will Require a Serious, Long Term Effort

September 4, 2018

The California Consumer Privacy Act (CCPA) was rushed through the legislature in just one week in June and was trumpeted by its sponsors as a huge win for consumers. In fact, we believe the sweeping new law will be bad for privacy, bad for consumers and bad for businesses.

The CCPA has several serious defects:

  • Forcing companies to aggregate all of their online and offline information about individual consumers from a variety of separate sources will create massive pools of sensitive information which will be highly tempting targets for data thieves.
  • Under the new law, any member of a household or even outside third parties can access information about everyone in that household. This could lead to stalking by a domestic abuser or violation of the privacy rights of a roommate.
  • The new law threatens to severely impact the offering of financial incentives such as loyalty programs, which provide benefits to millions of Californians.  

These are just a few of the defects with the new law, which will face companies with millions of dollars in compliance costs. Fixing the serious problems the CCPA creates will require a long-term effort from the business community. Fortunately the law does not take effect until 2020. Therefore, if we are proactive and persuasive about the serious defects of the CCPA there is still time to ameliorate these problems. It is critical that we begin reaching out to the California State Legislature, the Attorney General and after November 6th the new Governor to make a clear case for why major changes in the law are critical for both consumers and the business community.

Before the CCPA reached the Governor’s desk, the sponsors acknowledged there were serious technical drafting errors and pledged to work on a “clean up” bill during the month of August to fix those errors. The vehicle for the “clean up” bill was SB 1121 and that legislation passed before the legislature adjourned on August 31st

We worked closely with the California Chamber of Commerce and other industry groups and member companies to provide a detailed letter to the sponsors of the ”clean up” bill, outlining our proposals to rectify serious drafting errors in the CCPA. The final version of SB1121 addressed several important concerns: it delays enforcement of the Act until either 6 months after the publication of the Attorney General’s final regulations or July 1, 2020, whichever is sooner; and it clarifies that the new private right of action applies only to data breaches and not to any other parts of the Act.

These are useful changes but clearly only a modest first step in a sustained, long term effort that will be required to convince policymakers in the next legislative session that the CCPA needs a complete overhaul. We will continue to keep our members fully informed of these developments. 


You must be logged in to submit a comment.