ENTERPRISE | CONSUMER PRIVACY TIPS | DATA BREACHES & ALERTS | WHITEPAPERS

California AG Supports Proposed CCPA Amendments in SB 561

Yesterday, California State Senator Hannah-Beth Jackson announced SB561, a bill to amend the California Consumer Privacy Act (CCPA). The SB 561 amendments would extend the private right of action, eliminate the 30 day cure provision and revise the section allowing businesses to seek guidance from the California Attorney General. The changes are supported by California Attorney General Xavier Becerra.

Private Right of Action

For the private right of action, SB 561 would extend the ability of consumers to bring a civil lawsuit or class action under the law to all violations of the CCPA. To do so, it would add a clause in Section 1798.150(a) and strike a sentence added by the SB1121 amendments in Section 1798.150(c).

The private right of action that was part of the proposed ballot initiative was broader than the version that passed as part of AB 375. It allowed consumers who suffered a violation of the law to bring an action for statutory damages and specified that there need not be a loss of money or property for there to be an injury in fact to the consumer. It was not limited, as the law is currently, to companies that failed to implement reasonable data security practices. It also provided for statutory damages in the amount of $1000 or, in cases of knowing and willful violations, between $1000 and $3000.

When Congress and the Californians for Consumer Privacy negotiated AB375, they limited the scope of the civil action. The limitation was subsequently confirmed by an addition in SB1121, the technical corrections bill, which made clear that the private right of action only applied to violations of the requirement for reasonable security practices and did not extend to the rest of the new California privacy law.

This change is expected to ease the enforcement burden of the CCPA on the Attorney General. It has been supported generally in the past by the Electronic Frontier Foundation, which has argued that consumers should be able to seek remedies when the nation’s privacy laws are broken.

CA-AG-Supports-Proposed-SB561

30 Day Cure

This provision was first added into AB375. It specifies that a violation has not occured until the business has been notified of a suspected violation and failed to cure it after 30 days. It has been called a get out of jail free card for businesses by a representative of the Attorney General’s Office. For businesses, it offers them a chance to avoid the $2500-7500 penalties provided for by the CCPA. After the AGO representative at the Assembly Committee hearing called this a “get out of jail free card”, it is not surprising to see its removal proposed in an amendment.

The change proposed in SB561 only eliminates the 30 day cure provision for businesses subject to enforcement by the Attorney General. The private cause of action would continue to have its separate 30 day cure provision. This requires a consumer seeking statutory damages to provide notice of a violation and allow the business up to 30 days to avoid the lawsuit if a cure is possible. The business must provide the consumer an express written statement that the violations have been cured and no further violations shall occur.

AG Guidance

The California Consumer Privacy Act currently allows businesses and third parties to seek an opinion of the Attorney General on how to comply with the CCPA. The California AG has called this section “an unprecedented obligation of using public funds to provide unlimited legal advice to private parties” as well as creating a “potential conflict of interest by having the AGO provide legal advice to parties who may be violating the privacy rights of Californians”. SB 561 would eliminate it and replace it with authorization for the AG to “publish materials that provide businesses and others with general guidance on how to comply ….”

The California Attorney General Office’s representative recently argued for all three changes at last week’s CCPA hearings held by the California State Assembly’s Privacy and Consumer Protection Committee.

Update: Response from California Chamber of Commerce

The California Chamber of Commerce has issued a brief one paragraph statement today (February 26, 2018) in response to the proposed amendments to the CCPA. For those that are not familiar with the organization, their membership represents 1/4 of the private sector jobs in California.

CalChamber’s statement stresses that the goal of the CCPA should be compliance, not punishment. It expresses concern that the law is “new and vague” and that the result of these changes will be “costly litigation” against businesses that “inadvertently misstep” which will “primarily benefit trial attorneys.”

Other Bills

We still haven’t seen any changes in AB25, sponsored by Assemblymember Chau, which currently just expresses an intent to amend the CCPA.

Assemblymember Chau has introduced AB 1202 last week to require the registration of data brokers in California.

California State Senator Stern has introdued SB 753 to amend Section 1798.135 of the California Consumer Privacy Act. The bill would make only nonsubstantive changes to the current compliance requirements. It currently makes only three changes to remove capitalization of certain terms.

California AG Supports Proposed CCPA Amendments in SB 561

Contact

888-252-5653

About

Consumers

Businesses