California Legislators Advance Industry-Favored CCPA Tweaks

More work is ahead to fine-tune CCPA bills before final passage, said Privacy and Consumer Protection Committee Chairman Ed Chau (D) at the livestreamed hearing. Chau wants to “hold the line” and make sure the law he authored last year isn’t weakened. With about 30 bills introduced in the legislature to tweak CCPA, the Privacy Committee plans to consider more privacy bills Tuesday.

Several bills cleared by the committee would adjust CCPA definitions to exempt certain business behaviors. AB-25 would edit the definition of “consumer” to carve out personal data that businesses collect from job applicants, employers, contractors and agents. AB-846 makes exceptions for voluntary loyalty programs. AB-873 would narrow the definition of “personal information” including by adding a reasonableness standard to data “capable of being associated with” a specific consumer. It would redefine “deidentified” data “to mean information that does not reasonably identify, or link, directly or indirectly, to a particular consumer, provided that the business makes no attempt to reidentify the information, and takes reasonable technical and administrative measures” to ensure data is deidentified, publicly commits to maintain and use deidentified data and contractually prohibits data recipients from trying to reidentify data, said a bill analysis. “Publicly available” means information lawfully made available from government records under AB-874, which would delete language specifying conditions in which it isn’t publicly available.

Businesses would be required to give either a toll-free number or an email and physical address, plus a web form if it has a website, for consumer information requests under an amended AB-1564. That would change a CCPA requirement that businesses give consumers two or more ways to submit information requests. AB-1138 would prohibit social media sites from allowing children under 13 to sign up without parental consent.

Insurance companies would get an exemption from CCPA under AB-981, which would also add some CCPA concepts to the Insurance Information and Privacy Protection Act. AB-1146 would exempt vehicle data including ownership information that’s shared between a dealer and automobile manufacturer in anticipation of a repair.

Support came from state and national business associations, representing cable, tech, internet and videogame companies, plus retailers, advertisers, car sellers and medical device manufacturers. Consumer privacy groups including the American Civil Liberties Union and the Electronic Frontier Foundation opposed most bills.

Five bills passed by the committee “undercut consumer privacy,” AB-25, AB-846, AB-981, AB-873 and AB-1564, EFF Legislative Activist Hayley Tsukayama blogged. Chau “voted to significantly weaken both this law and the privacy rights he previously championed,” Tsukayama said. Consumer groups support SB-561 proposed by Attorney General Xavier Becerra (D), which cleared a key committee earlier this month (see 1904100051).

CCPA Edits

AB-25 would ensure that an individual retain privacy rights “as a consumer, but not in their capacity as an employee,” said author Chau. That will stop employees accused of sexual harassment from seeking to delete complaints about them, he said.

“There is far too much space for industry to abuse the opening” in AB-25, argued Ariel Fox Johnson, Common Sense Media senior counsel-policy and privacy. The exemption should be narrowly tailored to apply to only information necessary to employment or contracting, she said. “Given the ever-increasing corporate surveillance of the workforce,” including companies collecting movement data and trying to learn when employees are planning to conceive, “employers feel free to tie just about all types of information to employment.”

It doesn’t make sense to have different rules for the insurance industry, said ACLU-California attorney Jacob Snow after multiple insurance associations supported AB-981. And don’t relax the standard for data “capable of being associated” with a customer per AB-873, he said. Anonymized information is still private and can be reidentified, he said. Adding a reasonableness standard is “crucial to businesses,” countered California Chamber of Commerce Policy Advocate Sarah Boot.

Privacy advocates don’t oppose exempting loyalty programs from CCPA, but businesses should disclose what they’re doing with customer data and not charge to opt out, said Oakland Privacy coalition member and Media Alliance Executive Director Tracy Rosenberg, opposing AB-846. Privacy rights can’t come with fees, she said. CCPA as written doesn’t ban loyalty programs, said Californians for Consumer Privacy Chair Alastair Mactaggart.

Not requiring toll-free numbers makes it harder for consumers to contact businesses, especially those without internet access, said Common Sense’s Johnson, opposing AB-1564. An amendment requiring companies to at least give a physical address is good, but “snail mail” is no substitute for a phone number, she said. Conversely, Assemblymember Jay Obernolte (R) said allowing a company to provide a phone number but no online contact method might discourage some people from contacting the company.

Clarifying CCPA doesn’t target information in public records through AB-874 avoids possible violation of the First Amendment, said Software and Information Industry Association General Counsel Chris Moore. It ensures public domain information is available for tracking missing children, investigative journalism and other important uses, he said. The bill wasn't opposed.