Highlights of the CA Privacy Committee Hearing Yesterday on CCPA Amendments

It was a busy day on the California Consumer Privacy Act (CCPA) yesterday as the California Assembly Privacy and Consumer Protection Committee was scheduled to hear ten CCPA amendments and the Senate Judiciary Committee was scheduled to hear another one.

Eight privacy bills were sent to the Assembly Appropriations Committee during the public hearing: AB-25, AB-846, AB-873, AB-874, AB-981, AB-1138, AB-1146 and AB-1564.

There is a fairly short window for them to get the support needed to pass from here. The last day for fiscal committees to meet and report to the floor bills introduced in their house is May 17th and the last day for each house to pass bills introduced in that house is May 31st.

Here is a rundown on the proposed bills:

AB 25 – Excludes Employees

AB 25 excludes employees from the definition of consumer insofar as the data relates to the employee acting within the scope of the duties of an employee and not when otherwise acting as a consumer.

It also contains intent language for legislative action on the specific pieces of information to be provided by a business in a privacy protective manner in response to a right to access request given the potential concerns of providing sensitive information or personal information to the wrong person when, for example, the data relates to a shared device or household.

The organization Californians for Consumer Privacy suggested that either the term agent be defined or removed from the amendment given the current definition of the term contractor.

Cal Chamber spoke in favor of it as well as a large number of members of the public representing businesses and organizations.

AB 846 – Limited Exclusion for Loyalty Programs

Business organizations want to make clear that discount and rewards programs may continue and are supporting an exception from the non-discrimination provisions.

Californians for Consumer Privacy is concerned about what they are doing with the data and that consumers will be forced to have their information sold to get cheaper pricing. They also don’t believe the programs are barred by the current text of the CCPA.

The proponent indicated a willingness to work with the opponents in order to address objections in order to make sure that loyalty programs can continue and that consumers don’t get a negative opinion of the CCPA because of withdrawn discounts and rewards.

AB 873 – Changes to Personal and Deidentified Information Definitions

The bill makes changes to the definition of personal information and deidentified information. The author accepted the suggested amendments to the bill. It adds the word reasonably in front of capable of being associated with in the definition of personal information. There is already a reasonableness standard for personal information that is linked to a person and this adds the reasonableness standard in front of the other clause in the definition.

The portion of the bill over allowing access of one member of a household to delete the data of another member of the household was removed as recommended by the Committee’s suggested amendments.

Californians for Consumer Privacy removed their objections to the amendment and said that they would support it with the amendments. The ACLU of Northern California continued to oppose it because it creates loopholes in the CCPA.

AB 874 – Clarifies publicly available information exception around government data

It removes the restrictions placed on using personal information available in government records, such as the incompatible purpose restriction.

AB 981 – Insurance Information and Privacy Protection Act

This bill is a work in progress to avoid conflicts between the statutory schemes of the Insurance Information and Privacy Protection Act (IIPPA) and the CCPA. The bill excludes insurers and insurance transactions from a large portion of the CCPA and makes changes to the IIPPA which regulates them currently. The IIPPA is based on a model law and the proponents expressed support for the importance of uniformity in insurance laws.

It was opposed because of concerns about exempting an entire industry from the new privacy law and past data issues in the insurance industry, although there was optimism expressed by several that additional work could be done to close the gap between the concerns of industry and those advocating for consumer privacy protections.

AB 1138 – Requires parental consent for children under 13 to open social media account

The bill prohibits businesses from allowing children to open social media accounts without parental consent. The author accepted the suggested amendments of the committee to, in particular, lower the age to open an account where prohibited.

Although it was given a Do Pass as amended recommendation to Appropriations, a few members of the Committee expressed concern about how businesses can implement the prohibition and believe that changes need to be made to give them a reasonable set of requirements to implement in order to avoid liability. The author indicated a willingness to address the request.

AB 1146 – Excludes Warranty/Recall Vehicle Information from Opt-Out

It allows new motor vehicle dealers to maintain information on owners to provide for recall and safety defect notices.

Californians for Consumer Privacy opposed unless amended, asking for entities that receive the information to be prohibited from reselling it. Consumer Reports argued that the CCPA does not currently block the sharing provided by the bill.

AB 1564 – Provides Alternative to Toll-Free Number Requirement

The bill allows an option of either a toll-free number or both an email address and physical address. A supporting witness expressed concern about privacy and security issues around a toll-free number.

The testifying opponent expressed concern about lost mail and that individuals who do not use the internet would not be able to exercise their rights.

Pulled From Committee

AB 1760 – The bill formerly known as the Privacy for All Act of 2019 was pulled by the author before it was heard by the Assembly Privacy and Consumer Protection Committee.

SB 753 – The adtech exemption from the right to opt-out of the sale of personal information was pulled by the author before it was heard in the Senate Judiciary Committee yesterday.

Previously in Senate Judiciary Committee:

SB 561 – This Senate bill supported by the California Attorney General to expand the private right of action (and two other changes) made it through the Senate Judiciary Committee to the Appropriations Committee by a 6-2 vote a few weeks ago.

Other Relevant Posts:

Maine Considering LD 946 to Protect Privacy of ISP Customers
Illinois House Passes Data Transparency and Privacy Act; Senate Passes KIDS Act
Texas Considers Consumer Privacy Act and Privacy Protection Act
Update: Special Session of Appropriations Committee Saves Washington Privacy Act for Another Week
No Washington Privacy Act This Year?
Washington Privacy Act – Initial Look at the Current House Version
Summary of Connecticut SB 1108 on Data Privacy
Summary of Public Hearings on Maryland Online Consumer Protection Act
Summary of Washington Privacy Act After State Senate Passes
Florida Legislature Considers Biometric Information Privacy Act
Maryland Considering SB613 / HB0901 – Online Consumer Protection Act
With SD341, Massachusetts Joins States Considering CCPA-like Data Privacy Laws
Public Hearing on Washington Privacy Act (SSB 5376) in Senate Ways & Means – More Work to Be Done?
State CCPA Privacy Bills in Rhode Island, Hawaii and New Jersey
North Dakota Considers Study on Privacy Practices of Data Brokers