California AG Supports Proposed CCPA Amendments in SB 561
Yesterday, California State Senator Hannah-Beth Jackson announced SB561, a bill to amend the California Consumer Privacy Act (CCPA). The SB 561 amendments would extend the private right of action, eliminate the 30 day cure provision and revise the section allowing businesses to seek guidance from the California Attorney General. The changes are supported by California Attorney General Xavier Becerra.
Private Right of Action
For the private right of action, SB 561 would extend the ability of consumers to bring a civil lawsuit or class action under the law to all violations of the CCPA. To do so, it would add a clause in Section 1798.150(a) and strike a sentence added by the SB1121 amendments in Section 1798.150(c).
The private right of action that was part of the proposed ballot initiative was broader than the version that passed as part of AB 375. It allowed consumers who suffered a violation of the law to bring an action for statutory damages and specified that there need not be a loss of money or property for there to be an injury in fact to the consumer. It was not limited, as the law is currently, to companies that failed to implement reasonable data security practices. It also provided for statutory damages in the amount of $1000 or, in cases of knowing and willful violations, between $1000 and $3000.
When Congress and the Californians for Consumer Privacy negotiated AB375, they limited the scope of the civil action. The limitation was subsequently confirmed by an addition in SB1121, the technical corrections bill, which made clear that the private right of action only applied to violations of the requirement for reasonable security practices and did not extend to the rest of the new California privacy law.
This change is expected to ease the enforcement burden of the CCPA on the Attorney General. It has been supported generally in the past by the Electronic Frontier Foundation, which has argued that consumers should be able to seek remedies when the nation’s privacy laws are broken.
30 Day Cure
This provision was first added into AB375. It specifies that a violation has not occured until the business has been notified of a suspected violation and failed to cure it after 30 days. It has been called a get out of jail free card for businesses by a representative of the Attorney General’s Office. For businesses, it offers them a chance to avoid the $2500-7500 penalties provided for by the CCPA. After the AGO representative at the Assembly Committee hearing called this a “get out of jail free card”, it is not surprising to see its removal proposed in an amendment.
The change proposed in SB561 only eliminates the 30 day cure provision for businesses subject to enforcement by the Attorney General. The private cause of action would continue to have its separate 30 day cure provision. This requires a consumer seeking statutory damages to provide notice of a violation and allow the business up to 30 days to avoid the lawsuit if a cure is possible. The business must provide the consumer an express written statement that the violations have been cured and no further violations shall occur.
The California Consumer Privacy Act currently allows businesses and third parties to seek an opinion of the Attorney General on how to comply with the CCPA. The California AG has called this section “an unprecedented obligation of using public funds to provide unlimited legal advice to private parties” as well as creating a “potential conflict of interest by having the AGO provide legal advice to parties who may be violating the privacy rights of Californians”. SB 561 would eliminate it and replace it with authorization for the AG to “publish materials that provide businesses and others with general guidance on how to comply ….”
The California Attorney General Office’s representative recently argued for all three changes at last week’s CCPA hearings held by the California State Assembly’s Privacy and Consumer Protection Committee.
Update: Response from California Chamber of Commerce
The California Chamber of Commerce has issued a brief one paragraph statement today (February 26, 2018) in response to the proposed amendments to the CCPA. For those that are not familiar with the organization, their membership represents 1/4 of the private sector jobs in California.
CalChamber’s statement stresses that the goal of the CCPA should be compliance, not punishment. It expresses concern that the law is “new and vague” and that the result of these changes will be “costly litigation” against businesses that “inadvertently misstep” which will “primarily benefit trial attorneys.”
We still haven’t seen any changes in AB25, sponsored by Assemblymember Chau, which currently just expresses an intent to amend the CCPA.
Assemblymember Chau has introduced AB 1202 last week to require the registration of data brokers in California.
California State Senator Stern has introdued SB 753 to amend Section 1798.135 of the California Consumer Privacy Act. The bill would make only nonsubstantive changes to the current compliance requirements. It currently makes only three changes to remove capitalization of certain terms.
Other Relevant Posts:
Next Stop for CCPA Amendments AB-25 and AB-874 is an Assembly Floor Vote
Highlights of the CA Privacy Committee Hearing Yesterday on CCPA Amendments
How to Prepare for CCPA Compliance Given the Uncertain Amendments and Regulations
CCPA Amendments to be Heard in April 23rd California Assembly Privacy Committee Hearing
Senate Judiciary Committee Recommends SB 561, the Expanded CCPA Private Right of Action
Latest on the Proposed CCPA Amendments
AB-25 Proposes CCPA Amendment to Exclude Employees from New Privacy Law
CCPA Regulation Recommendations by EFF to CA Attorney General
Highlights of CCPA Rulemaking Comments by IAB and ANA
CCPA Amendment & Consumer Privacy Bills in California legislature in Feb. 2019
CA Dems Defend CCPA Against Preemption; California Holds CCPA Hearing on Changes
California GOP Defend CCPA Against Federal Preemption
More Technical Amendments Suggested for CCPA; CA GOP Introduce Another Privacy Bill
Advertising & Marketing Groups Send AG Letter Seeking Flexibility on CCPA