Latest on the Proposed CCPA Amendments

The proposed bill (SB561) to amend the California Consumer Privacy Act (CCPA) to extend the private right of action, eliminate the 30 day cure provision, and rework the section requiring Attorney General guidance for businesses is on the agenda for today’s Senate Judiciary Committee hearing in the California legislature. The bill is supported by the California Attorney General and was proposed by the head of the Committee, California Senator Hannah-Beth Jackson (D-Santa Barbara).

The bill analysis of SB 561 contains a summary of the CCPA amendments. We have previously provided a summary of the CCPA bills, but since our last summary blog post on the amendments was before the modification of AB-25 to eliminate employees from the definition of consumer, we have decided to replicate the summaries provided to the Senate Judiciary Committee here:

SB 561 (Jackson, 2019) expands the consumer enforcement mechanism, enabling consumers to enforce their own rights pursuant to the CCPA. The bill also removes the ability for violators to “cure” their violations of the law before the AGO is able to hold them accountable through an enforcement action. Finally, in order to avoid the potentially massive drain on public resources, the bill modifies the legal opinions provision of the law and instead authorizes the AGO to provide general guidance on compliance with the law.

SB 753 (Stern, 2019) provides that a business does not sell personal information if the business, pursuant to a written contract, shares, discloses, or otherwise communicates to another business or third party a unique identifier only to the extent necessary to serve or audit a specific advertisement to the consumer. The bill requires the contract to prohibit the other business or third party from sharing, selling, or otherwise communicating the information except as necessary to serve or audit advertisement from the business. This bill is currently in the Senate Rules Committee.

AB 25 (Chau, 2019) excludes from the definition of “consumer” in the CCPA a natural person whose personal information has been collected by a business in the course of a person acting as a job applicant or as an employee, contractor, or agent, on behalf of the business, to the extent their personal information is used for purposes compatible with the context of the person’s activities for the business as a job applicant, employee, contractor, or agent of the business. The bill states the intent to further clarify how a business shall comply with requests for specific pieces of information. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 288 (Cunningham, 2019) provides that when a user of a social networking service deactivates or deletes the user’s account, the service shall provide the user the option of having the user’s personally identifiable information permanently removed from any database controlled by the service, from the service’s records, and to prohibit the service from selling that information to, or exchanging that information with, a third party in the future. Consumers are authorized to bring civil actions for damages that occur as a result of violations of the bill, including attorney’s fees, pain and suffering, and punitive damages, as specified. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 846 (Burke, 2019) amends the non-discrimination provisions of the CCPA. It also removes the prohibition on businesses’ use of financial incentive practices that are unjust or unreasonable. It also clarifies that loyalty and rewards programs are not restricted by the CCPA. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 873 (Irwin, 2019) loosens the definition of “deidentified” and narrows the definition of “personal information” in the CCPA. It removes from the definition of “personal information” information that can identify a particular household. It also removes the requirement that a business reidentify or otherwise link certain information for purposes of the CCPA. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 874 (Irwin, 2019) amends the definition of “personal information” in the CCPA. It removes the application of the CCPA to publicly available information that is used for a purpose that is not compatible with the purpose for which the data is maintained and made available in government records or for which it is publicly maintained. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 950 (Levine, 2019) requires a business that conducts business in California and that collects a California resident’s consumer data to disclose to the consumer the monetary value to the business of their consumer data through various methods. If the data is sold, the business is required to disclose the average and actual price that is paid. The bill also establishes the Consumer Data Privacy Commission to provide guidance to the Legislature and to submit a report regarding appropriate metrics and methodology for determining the monetary value of consumer data. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 981 (Daly, 2019) exempts from the protections and provisions of the CCPA insurance institutions, agents, insurance-support organizations, or insurance transactions, as specified. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1138 (Gallagher, 2019) prohibits a person or business that conducts business in California, and that operates a social media website or application, from allowing a person under 16 years of age to create an account with the website or application unless the website or application obtains the consent of the person’s parent or guardian before creation of the account. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1146 (Berman, 2019) exempts from the protections and provisions of the CCPA vehicle information, including ownership information, shared between a new motor vehicle dealer and the vehicle’s manufacturer, if the vehicle information is shared pursuant to, or in anticipation of, a vehicle repair relating to warranty work or a recall, as specified. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1202 (Chau, 2019) requires data brokers to register with, and provide certain information to, the Attorney General. Such information must be made publicly accessible. This bill is currently in the Assembly Appropriations Committee.

AB 1355 (Chau, 2019) amends the definitions of “publicly available” and “personal information.” This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1395 (Cunningham, 2019) prohibits a smart speaker device, or a smart speaker device manufacturer, from saving or storing recordings of verbal commands or requests given to a smart speaker device, or verbal conversations heard by the smart speaker device, regardless of whether the smart speaker device was triggered using a key term or phrase. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1416 (Cooley, 2019) expands the exemptions within the CCPA, specifically including additional conduct that a business is able to engage in without restriction from the CCPA. This includes the ability to disclose personal information to assist another person to exercise legal claims and to protect against fraud or unauthorized transactions. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1564 (Berman, 2019) reduces the methods a business must make available to consumers for submitting requests for information required to be disclosed pursuant to the CCPA. It removes the requirement that a business provide a toll-free telephone number for such purposes. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1760 (Wicks, 2019) renames the CCPA the California Privacy for All Act of 2019 and strengthens various protections for consumers, including a change from opt-out consent for the sale of information to opt-in consent for the sharing of information. The bill also includes data minimization requirements and modifies various definitions. The bill expands the consumer enforcement mechanism within the CCPA, providing for a right of action for all violations of the CCPA and eliminating the right to cure. It also explicitly allows district attorneys, city attorneys, and county counsel to bring actions on behalf of the people for violations of the CCPA in addition to the Attorney General. It also removes the provision regarding the legal opinions of the Attorney General. This bill is currently in the Assembly Privacy and Consumer Protection Committee.

Other Relevant Posts:

Next Stop for CCPA Amendments AB-25 and AB-874 is an Assembly Floor Vote
Highlights of the CA Privacy Committee Hearing Yesterday on CCPA Amendments
How to Prepare for CCPA Compliance Given the Uncertain Amendments and Regulations
CCPA Amendments to be Heard in April 23rd California Assembly Privacy Committee Hearing
Senate Judiciary Committee Recommends SB 561, the Expanded CCPA Private Right of Action
Latest on the Proposed CCPA Amendments
AB-25 Proposes CCPA Amendment to Exclude Employees from New Privacy Law
CCPA Regulation Recommendations by EFF to CA Attorney General
Highlights of CCPA Rulemaking Comments by IAB and ANA
CCPA Amendment & Consumer Privacy Bills in California legislature in Feb. 2019
California AG Supports Proposed CCPA Amendments in SB 561
CA Dems Defend CCPA Against Preemption; California Holds CCPA Hearing on Changes
California GOP Defend CCPA Against Federal Preemption
More Technical Amendments Suggested for CCPA; CA GOP Introduce Another Privacy Bill
Advertising & Marketing Groups Send AG Letter Seeking Flexibility on CCPA