Privacy Interests Brace for Busy Year Tweaking CCPA

“We’re going to listen to everybody and figure out whether fixes need to be made where we might have made mistakes, where the law needs to be strengthened” and “where it needs to reflect certain business models that we might have missed,” said Senate Majority Leader Bob Hertzberg (D). The first package of technical fixes passed last year (see 1809040053).

The California AG office plans to publish proposed rules this fall and is now doing "preliminary outreach" for the CCPA-required rulemaking, which is "independent" from the legislative process, said a spokesperson for AG Xavier Becerra (D).

All kinds of lobbyists are contacting lawmakers about possible edits, said Hertzberg, who expects to sponsor a bill with Sen. Bill Dodd (D). Privacy Committee Chair Ed Chau (D) probably will have an Assembly bill, Hertzberg said. The Assembly is likely to pass a “pretty slender bill” in June, then the Senate would act in late August or early September near session's end and Gov. Gavin Newsom (D) would sign by year-end, Hertzberg said. Legislators are watching the AG process, which could solve many people’s issues with the law, he said: “We’ll be working on any other fixes that are necessary that aren’t being fixed by the regs.”

Each side fears the other will try to get more than it did in 2018, said Hertzberg. Many will seek legislative changes to exempt their industries, but the law struck a “sensitive balance between protecting consumers and making sure people can still operate their businesses,” he said. Hertzberg seeks to preserve the law’s “core values,” including users’ rights to delete and control their personal information.

“We made gigantic strides” last year, said Hertzberg, saying it’s unlikely a bill would have passed if not for the threat of a ballot initiative. It took 90 days of lawmaker negotiation, he said. It’s a complicated issue given many interest groups and fast-changing technology, said the legislator: Congress has “got a better chance of building a border wall than they do of getting privacy legislation.”

Fight Seen

Becerra is holding forums (see 1901100014). The next three are Feb. 5 in Sacramento, Feb. 13 in Fresno and March 5 in Stanford. Written comments are due March 8. Legislative bills must be introduced by Feb. 22, voted on by policy committees by April 26 and appropriations committees by May 17, and pass floor votes in originating chambers by May 31. In the other chamber, bills must be heard by policy committees by July 10, appropriations by Aug. 30, final amendments by Sept. 5 and passed by Sept. 13.

“The actual fight is this year," with focus on the legislature, said Electronic Frontier Foundation Legislative Counsel Ernesto Falcon. Passing the bill last year was about “warding off the ballot initiative,” reserving 2019 to fix any errors, he said. Privacy advocates will try to add teeth, and industry probably will try to remove them, he said: The battle probably goes “right up to the eleventh hour” of session.

Much work remains because of how quickly the ordinance was adopted, with legislators recognizing then that changes would be needed, said Alan Tilles of Shulman Rogers. It’s “absolutely” another bite at the apple for those not satisfied, he said. “They’d be silly not to try.” Bills rarely are perfect on first try, even those put together more deliberately, he said. Tilles expects “functional discussion,” including on impact to businesses of different sizes and companies based outside of California with business there.

Quick passage created internal inconsistencies and undefined or overbroad terms, said Larose, a privacy lawyer for businesses. The broad definition of consumer includes employees, but CCPA data restrictions don’t make sense in the employer-employee relationship where data is used for payroll and human resources, she said. “I’m sure that during the amendment process, both sides have their lobbyists trying to craft amendments that are as favorable as possible to their positions.”

Issues arising during AG implementation likely will inform the legislative process, Tilles said. “The worst thing for business is uncertainty,” so it’s better for the legislature to clarify a rule rather than rely on an interpretation that could be challenged in court, Tilles said. It will be better for businesses if the amendments don’t drag on, he said.

Lobbying Starts

EFF hopes for an amendment “expanding people’s ability to sue the companies that violated their privacy,” Falcon said. The privacy group would rather have opt-in than opt-out consent currently in the law, he said. He predicted opposition from Google, Facebook, AT&T, Verizon and cable. Only Facebook commented.

Facebook believes “people should be in control of their information online and companies should be held to high standards in explaining what data they have and how they use it, especially when they sell data," said Vice President-State and Local Public Policy Will Castleberry in a statement. Facebook is participating in the AG process. “We are committed to being clear with people about how our services work, including the fact that we do not sell people’s data.”

“Without clarification and adjustments,” the Association of National Advertisers and four other ad groups wrote Becerra Thursday, “ambiguities" could reduce "choice and privacy for consumers, rather than expanding it.” If changes can’t be made through rulemaking, “we urge you to make such recommendations to the California Legislature.” Advertisers raised concerns including about the definition of personal information and possible elimination of loyalty programs under nondiscrimination rules. Firms should be allowed to give consumers choices of opting out of some but not all sales, or deleting only parts of their data, and the AG should clarify a business doesn’t have to write individualized privacy policies for each consumer, they said.

Verizon urged 2019 federal privacy legislation Thursday (see 1901310043). Sen. Marco Rubio, R-Fla.'s bill would pre-empt state laws (see 1901170044).

A federal privacy law is better than 50 state laws, but states will continue to update their laws as congressional inaction continues, Tilles said. “If you don’t see federal legislation after some of the hugely impactful breaches that have happened so far, I have no confidence there will be any.” A federal privacy bill seems years away, Falcon said. Larose “stopped trying to predict federal privacy legislation a long time ago.”