California Assembly Approves CCPA Amendments AB-874, AB-1355 and AB-1564
The California Assembly has unanimously approved three amendments to the California Consumer Privacy Act (CCPA) in the last week: AB-874 (personal information definition), AB-1355 (technical amendments), and AB-1564 (toll-free number alternative). The three bills will now be considered by the California Senate.
Here is a summary of the bills:
AB 874 – Publicly Available Information
This proposed bill clarifies the contours of the publicly available information exception to the definition of personal information. Specifically, it eliminates the “purpose” requirement within the exception. As a result, information lawfully made available in federal, state or local government records will be considered “publicly available” and excluded from the definition of personal information.
AB 1355 – Technical Amendments
AB1355 clarifies various elements of the CCPA text and corrects a few drafting errors. The prospective changes include:
– Fixes a drafting error in the definition of personal information. The amendment would exclude deidentified and aggregate consumer information from the definition of personal information.
– Modifies references suggesting that a business needs to publicly disclose information about a specific consumer. Instead, they will need to publicly disclose the categories of personal information collected about consumers and the right to request the specific pieces of information collected.
– Clarifies that the right to opt-in applies to consumers who are 13 years of age and less than 16 years of age. A minor drafting error created ambiguity as to whether people who are 16 years of age were or were not included in this section. If this bill becomes law, 16 year olds will be part of the opt-out and not the opt-in.
– A number of cross-references to other sections are also cleaned up by the amendment.
AB 1564 – Toll Free Number Alternative
The CCPA currently requires a business to have two or more designated methods available to consumers to make requests under the law. The business must have a toll-free telephone number. If it has an internet website, it also must provide a means to do so on its website.
This proposed CCPA amendment would allow for a business to substitute an email address and physical address for the toll-free telephone number requirement. This would allow consumers to exercise their new privacy rights by email or mail rather than require them to call. The bill is supported by a number of business groups which support increased flexibility around compliance with the law. They expressed concerns that it would be an additional cost for some businesses to buy and staff a phone number as well as pose challenges for consumer verification.
AB-873 (deidentified information definition) and AB-981 (insurance exclusion) are on the agenda for the CA Assembly Appropriations Committee today.
AB-25 (employee data) is the bill that was expected to be in this group but has not yet passed. We don’t have any inside information on the hold up but can only guess that they are still trying to gather consensus on the second section of the bill – the clarification of responding to “a consumer’s request for specific pieces of information in a privacy protective manner.” This might include the procedures for verification of a consumer or additional specification around responding to requests with household or device information that may implicate more than one consumer.
For additional information about the California Consumer Privacy Act, please see our CCPA summary.