California Privacy Bill Parade Continues Through Assembly

Appropriations agreed to changes including AB-25 to edit the 2018 law’s definition of “consumer” to carve out personal data that businesses collect from job applicants, employers, contractors and agents; AB-874 clarifying that “publicly available” information includes that lawfully made available from government records; and AB-1355 to exclude de-identified or aggregate consumer information from the definition of personal information. AB-25 was one of several industry-backed bills opposed last week by consumer privacy advocates at a Privacy Committee hearing (see 1904240037).

The Committee cleared CCPA tweaks including AB-1416 to clarify the law doesn't restrict business' ability to comply with rules or regulations and, specifically, to collect, use, retain, sell, authenticate or disclose personal information for uses including legal claims, fraud prevention and security; and AB-1035 requiring data breach disclosures “in the most expedient time possible and without unreasonable delay, but in no case more than 45 days.” Members widely supported AB-1665 to require social networks to obtain parental consent before using a minor’s personal information.

AB-1416 is overly broad and could “gut the bottom out of CCPA,” said Corbin and Kaiser CEO Samantha Corbin, representing consumer privacy groups in California. Lawmakers must preserve consumers’ constitutional right to privacy unless there's a specific need such as a warrant, said Doug Supers, representing Californians for Consumer Privacy. Supporters included Tesla, Symantec, CTIA, the Internet Association and California State Association of Counties. Assemblymember Ken Cooley (D) said he added a four-year sunset to his bill so legislators can scrap or adjust the proposed policy if needed.

The data breach bill’s 45-day time frame is too long for notification, said Corbin and other bill opponents. Noting the original bill had 72 hours, sponsor Assemblymember Chad Mayes (R) said he’ll continue to negotiate that. While open to a different number, Chairman Ed Chau (D) said he likes 45 days because the state attorney general reports that 40 days is average.

The Privacy panel agreed to a plan to stop smart speakers from saving, storing or exchanging recordings with a third party, regardless of whether the device was triggered using a key phrase like “OK Google,” unless the consumer opts in. “It strengthens privacy,” said Chau of AB-1395 by Assemblymember Jordan Cunningham (R).

Assemblymember Jay Obernolte (R) wants more work to ensure the bill doesn’t make such devices inoperable. Devices at least need to store audio in internal memory, he said. Cunningham agreed to tighten that language, saying it’s important to give consumers a choice. Requiring opt-in is a commensurate response to the big eavesdropping threat posed by smart speakers, he said. Assemblymember James Gallagher (R) agreed: "When it comes to your home, it should be opt in," because it's the "most private and sacred place.”

“Devices are not listening in,” said TechNet Executive Director-California Courtney Jensen. "Companies may review a small number of de-identified utterances recorded from a random set of customers in order to audit and improve machine-learning tools," including speech recognition and natural language systems, she said. Having opt-in for AB-1395 while CCPA requires opt-out is confusing, she added.

Members supported two measures responding to wireless industry controversies: AB-523 on reports that carriers sold customers’ real-time data location, and AB-1699, responding to Verizon's throttling traffic of Santa Clara County firefighters during the Mendocino Complex Fire last year (see 1904250024).

CTIA downplayed those issues again (see 1904250024). The wireless location-privacy bill is too technology-specific and requiring written consent isn’t ideal, said Government Affairs Counsel Steve Carlson. Firefighter throttling was an “isolated and unique incident,” said Carlson, noting states mightn't have jurisdiction. AB-1699 sponsor Assemblymember Marc Levine (D) replied it’s “not a one-time incident” because he’s heard similar stories from other first responders.

The panel backed a measure requiring more transparency by e-commerce marketplaces like Amazon to their third-party sellers. Gallagher supported AB-1790 by Assemblymember Buffy Wicks (D), comparing Amazon to a railroad and saying Republicans like him are just as concerned about corporations amassing too much power as they are about too much government regulation.

The company feels unfairly singled out, complained Amazon Marketplace Associate General Counsel Charles Wright. The retail market is competitive, the e-tailer isn’t as dominant as some people think, and the company has incentive to help sellers succeed, he said. Other bill foes included TechNet, the Internet Association and CompTIA.

The Communications and Conveyance Committee greenlit a privacy bill by Chair Miguel Santiago (D) to allow phone companies to share phone numbers without consent to public safety for testing 911 response and emergency alert systems. AB-1079 passed Wednesday without discussion as part of the consent calendar.

The Communications panel voted 8-0 to ban the California Public Utilities Commission from assessing state USF fees upon information services as classified by the FCC. AB-162 responds to a recent CPUC proposal to extend fees to text messaging, said sponsor Assemblymember Kevin Kiley (R). The CPUC withdrew that following an FCC ruling clarifying the issue (see 1901310023), but proponents of assessing SMS haven't backed down, he said. Taxing texts makes service less affordable, Kiley said.