CCPA Proposed Amendments Update
August 2019
By Ethan Watts
Introduction
Earlier this year, I posted an article on California’s new sweeping data privacy law, the California Consumer Privacy Act (Sections 1798.100 - 1798.199 of the California Civil Code) (“CCPA”), which goes into effect on January 1, 2020. (See Does The New California Data Privacy Law Apply To Your Small Business? And If So, Is Your Business Ready To Comply?.) Since the drafting of that article, there have been numerous proposed amendments to the CCPA (Assembly Bills (“AB”) and Senate Bills (“SB”)), many of which appear to be close to passing while others appear to be dead, at least for now. This article summarizes various proposed amendments to the CCPA that have survived and continue to make their way through the California legislature, and also summarizes notable proposed amendments that now appear dead.
Key Proposed Amendments That Have Survived (So Far)
AB-25 (work and employee related information exemption):AB-25 amends the CCPA by adding subdivision 1798.145(g), which exempts from the CCPA’s requirements personal information and other information collected about job applicants, employees, contractors, owners, directors, officers and medical staff if the personal information is collected and used solely within the context of a consumer’s role or former role as a job applicant, employee, etc. However, this exemption created by new subdivision 1798.145(g) does not apply to (1) the CCPA’s requirement that a business inform consumers as to the categories of personal information to be collected at or before the point of collection, (2) consumers’ right under the CCPA to request disclosure of personal information collected and (3) consumers’ private right of action as a result of data breaches. AB-25 also includes a sunset provision making the new subdivision 1798.145(g) inoperative on January 1, 2021.
AB-846 (customer loyalty programs):
AB-846 amends the CCPA by adding new section 1798.126, which provides that businesses will not be prohibited from offering a different price, rate, level or quality of goods or services to consumers in connection with consumers’ voluntary participation in programs such as loyalty or rewards programs. The proposed amendment also clarifies that new section 1798.126 does not impact consumers’ rights regarding the sale of personal information, such as the right to “opt-out” of the sale of such information, and prohibits the sale of personal information collected as part of loyalty or rewards type programs.
AB-874 (clarified definition of “personal information”):
AB-874 revises and clarifies the “publicly available information” exclusion from the definition of “personal information” under the CCPA. The proposed amendment also adds an exclusion for deidentified or aggregated information from the definition of “personal information.”
AB-1146 (vehicle information and ownership information exemption):
AB-1146 creates a carve-out for certain vehicle and ownership information retained or shared between vehicle manufacturers and new motor vehicle dealers from consumers’ right to “opt-out” of the sale of their personal information.
AB-1355 (clean up and correct drafting errors):
AB-1355 cleans up various drafting errors and makes several non-substantial clarifying edits to various provisions of the CCPA.
AB-1564 (methods for submitting consumer requests):
The CCPA currently would require all businesses that fall under its purview to provide consumers with at least two methods for submitting consumer requests, one of which must be a toll-free telephone number. AB-1564 amends the CCPA to allow businesses that operate exclusively online and have direct relationships with consumers to only provide an email address for submitting consumer requests. The proposed amendment also requires businesses that have websites to make those websites available for submitting consumer requests.
Notable Proposed Amendments That Did Not Survive (For Now)
AB-873 (revised definition of “deidentified” and narrowed definition of “personal information”):AB-873 would have broadened and clarified the definition of “deidentified” information and narrowed the definition of “personal information.”
AB-1416 (removed certain restrictions in sharing and selling personal information):
AB-1416 would have amended section 1798.145 of the CCPA and would have repealed that section as of January 1, 2024. The proposed amendments to section 1798.145 clarified and removed restrictions on businesses related to, in certain circumstances, providing personal information to government agencies and the sale of personal information of a consumer who has opted-out.
SB-561 (expanded consumer private right of action):
The CCPA provides a private right of action to consumers whose nonencrypted or nonredacted personal information is subject to a data breach as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices. SB-561, sponsored by the California Attorney General, would have amended the CCPA to include a private right of action for any violation of the CCPA (not just as a result of data breaches) and would have deleted language allowing businesses 30 days to “cure” alleged violations before being potentially subject to injunctions and liable for civil penalties in civil actions brought by the Attorney General.
Key Upcoming California Legislative Deadlines
- September 6, 2019: last day to amend bills on the floor.
- September 13, 2019: last day for each house to pass bills.
- October 13, 2019: last day for the Governor to sign or veto bills passed by the Legislature on or before the 2019 deadline.
See https://www.senate.ca.gov/legdeadlines
The substance of this article was also posted on the San Diego County Bar Association's website here.
******************************************
The above discussion is intended to be a general commentary on legal issues. Each situation is different and this article is not intended as legal advice. Further, nothing in this article is intended to create an attorney-client relationship.