CCPA Amendments to be Heard in April 23rd California Assembly Privacy Committee Hearing

The California Assembly Privacy and Consumer Protection Committee will meet Tuesday with ten proposed bills to amend the California Consumer Privacy Act (CCPA) on the agenda. The proposed bills range from technical corrections to correct and clarify items not handled in SB 1121 as well as broad, sweeping changes such as AB 1760 (previously known as the Privacy for All Act of 2019).

Here is a brief summary of the CCPA amendments that are on the agenda for Tuesday:

AB 25 – California Consumer Privacy Act of 2018.
This bill provides a limited exclusion for employees and job applicants, among others. It was amended last week to make a few grammatical changes and to define the term contractor. Section 2 of the bill, which indicates an intent to clarify how a business shall comply with a consumer’s request for specific pieces of information, has not been expanded upon.

AB 846 – Customer loyalty programs.
This bill would amend the prohibition on discrimination in the CCPA to allow voluntary participation in a loyalty, rewards or discount program.

AB 873 – California Consumer Privacy Act of 2018.
This bill makes changes to the definition of personal information. It removes the term household from the definition of “personal information” and alters the definition of “deidentified” to make it easier to meet the requirements.

AB 874 – California Consumer Privacy Act of 2018.
This bill removes a limitation on the exclusion of personal information under the publicly available information exception. Information will still be publicly available even if it is used for a different purpose than why it is maintained in government records. It also clarifies that deidentified or aggregate consumer information is not personal information.

AB 981 – Insurance Information and Privacy Protection Act.
The bill would harmonize the requirements of the Insurance Information and Privacy Protection Act with the CCPA and exempt insurance institutions, agents and support organizations from the CCPA, except for the private right of action for certain data breaches.

AB 1138 – Social media: the Parent’s Accountability and Child Protection Act.
This bill requires a social media website or application to not allow a person under 16 years of age to create an account without parental consent. The Department of Justice would be tasked with establishing guidelines governing the means to obtain consent on or before January 1, 2021.

AB 1146 – California Consumer Privacy Act of 2018: exemptions: vehicle information.
This bill excludes vehicle information shared in connection with a vehicle repair relating to warranty work or a recall between a new motor vehicle dealer and the vehicle’s manufacturer. The excluded information includes the vehicle information number, make, model, year, odometer reading, registered owner names and their contact information. The bill maintains the requirement on this information to make certain disclosures in the privacy policy, the right to access, and the private right of action for certain data breaches.

AB 1355 – Personal information.
This bill makes a few technical corrections to the CCPA including clarifying the age of consent for minors and altering reference to the public disclosure of specific pieces of personal information about a consumer.

AB 1564 – Consumer privacy: consumer request for disclosure methods.
This bill amends the CCPA to give a business the option of providing either a toll-free telephone number or email address to make requests for information. The CCPA previously required a business to maintain toll-free number. A business that maintains a website will need to make the internet website available to submit requests for information.

AB 1760 – California Consumer Privacy Act of 2018.
Originally intending to rename the CCPA to the Privacy for All Act of 2019, AB1760 has recently been amended to remove the new name and eliminate the broad private right of action. Even with these removals, it still imposes sweeping changes to the text of the privacy law adopted last year. It also delays the effective date of the bill to January 1, 2021. Some of the key changes include:

– Restricts collection of personal information and sharing with third parties to that reasonably necessary to provide the service or activity the consumer has requested.

– Allow consumer to request deletion of all personal information, not just information collected from the consumer.

– Opt-in for data sharing which must be obtained separately from any other permission or consent. It changes the clear and conspicuous link to be titled, “Do Not Share My Personal Information”.

– Strengthens the anti-discrimination policy by removing the ability to offer financial incentives.

– Requires disclosure as part of the right to access of the specific third parties with whom the business shares personal information.

– Alters the exemptions to the right to delete to provide for a reasonable delay in compliance with the request rather than an exemption from the request.

– Requires businesses to make reasonable efforts to ensure compliance by service providers to avoid liability.

– Allows enforcement by city and county attorneys in addition to the Attorney General.

– Eliminates the 30 day cure for noncompliance.

Tuesday’s hearing of the Privacy and Consumer Protection Committee will provide decent insight into where the support lies for CCPA amendments. There are a few Senate amendments that are not included in the hearing, including the controversial expansion of the private right of action contained in SB 561. However, with ten bills up for discussion, it should provide a better idea of what the CCPA could look like by the end of the year.

Once there has been some additional clarity on upcoming amendments, the remaining uncertainty will be around the pending regulations from the California Attorney General. The first draft of the results from the start of the AG rulemaking process is expected in Fall 2019.

Other Relevant Posts:

Next Stop for CCPA Amendments AB-25 and AB-874 is an Assembly Floor Vote
Highlights of the CA Privacy Committee Hearing Yesterday on CCPA Amendments
How to Prepare for CCPA Compliance Given the Uncertain Amendments and Regulations
Senate Judiciary Committee Recommends SB 561, the Expanded CCPA Private Right of Action
Latest on the Proposed CCPA Amendments
AB-25 Proposes CCPA Amendment to Exclude Employees from New Privacy Law
CCPA Regulation Recommendations by EFF to CA Attorney General
Highlights of CCPA Rulemaking Comments by IAB and ANA
CCPA Amendment & Consumer Privacy Bills in California legislature in Feb. 2019
California AG Supports Proposed CCPA Amendments in SB 561
CA Dems Defend CCPA Against Preemption; California Holds CCPA Hearing on Changes
California GOP Defend CCPA Against Federal Preemption
More Technical Amendments Suggested for CCPA; CA GOP Introduce Another Privacy Bill
Advertising & Marketing Groups Send AG Letter Seeking Flexibility on CCPA