California Legislature Holds a Hearing on the California Privacy Rights Act Ballot Initiative

As reported by the International Association of Privacy Professionals, the California State Assembly held a hearing on June 12 on the California Privacy Rights Act ballot initiative.

Californians for Consumer Privacy, an advocacy group headed by Alastair Mactaggart, the proponent of the 2018 ballot initiative that led to the enactment of the CCPA, has gathered more than 900,000 signatures to place the CPRA on the ballot in November of 2020.  The group has recently filed a lawsuit to get California officials to finish verification of the signatures before the June 25 deadline for putting the initiative on the ballot.

If enacted, the CPRA will significantly amend the CCPA and further expand privacy rights of California consumers as well as compliance obligations of California businesses and their service providers and contractors.  The CPRA will, among other things, permit consumers to: (1) prevent businesses from sharing (in addition to selling) personal information; (2) correct inaccurate personal information; and (3) limit businesses’ use of “sensitive personal information,” such as precise geolocation, race, ethnicity, religion, genetic data, union membership, private communications, and certain sexual orientation, health, and biometric information.  The proposed law will prohibit businesses from collecting and using personal information for purposes incompatible with the disclosed purposes, and from retaining personal information longer than reasonably necessary.  The CPRA will also establish a new California Privacy Protection Agency which will be tasked with enforcing and implementing consumer privacy laws and imposing administrative fines.  The CPRA would become operative on January 1, 2023 and its obligations would only apply to personal information collected after January 1, 2022.

One of the main concerns expressed by the legislators at the hearing was the timing of the proposal given that businesses were still struggling to comply with the CCPA and the accompanying regulations just finalized by the Attorney General.  Industry representatives stated that “giving [businesses] another law to grapple with right now would be devastating” and that “adding the potential of a CPRA to the table is anxiety-inducing for businesses who are feeling the uncertainty of the regulatory landscape and seeking clarity.”   In response, Mactaggart noted that the CPRA “only builds” on the CCPA and cited the CPRA’s delayed enforcement date of 2023.

In addition to timing, a number of groups testified in opposition to some of the CPRA’s provisions, such as lack of a universal mechanism for opt out of the sale of the consumers’ personal data.  Others criticized the proposed data minimization provision that bases the duty to minimize on a business’s purposes rather than consumers’ expectations.

Other witnesses testified that, despite the initial success with using the ballot initiative to pass the CCPA, a ballot initiative is not an appropriate method to pass a new privacy law this time around.

 Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653