CCPA 2.0 And Where We Go From Here
By Lindsey Tonsager, Libbie Canter & Alexandra Scott on May 15, 2020
Posted in California Consumer Privacy Act (CCPA), Data Privacy, Privacy and Data Security, State Legislatures, United States
On May 4th, 2020, Californians for Consumer Privacy confirmed that they had submitted hundreds of thousands more signatures than required to qualify for a ballot initiative. It is still yet unknown whether the Attorney General will qualify the ballot for the November 2020 election, let alone whether it would pass. If the initiative passes, it will be noteworthy for a number of reasons.
Effect on Other Legislation.
CCPA.Over the course of 2018 and several periods of intense negotiations during 2019, California passed and significantly amended the novel California Consumer Privacy Act (“CCPA”). Widely known as the first omnibus privacy state legislation of its kind in the United States, consumers and industry advocates alike worked hard to prepare for the CCPA in the lead up to its January 1, 2020 effective date. Companies overhauled their privacy policies, revamped their contract templates, and designed new systems with the goal of complying with this legislation. If the ballot initiative appears on the November ballot, and if it passes, companies will have to reconsider and likely augment the privacy programs that they just built. Some of the new features of the ballot initiative include a new correction right, a new agency to enforce privacy law in California, as well as a clarification that protecting security and preventing fraud and illegal activity is a business purpose.
Personnel privacy rights. Unless extended, partial exemptions under the CCPA for employees’ and business-to-business data are scheduled to expire at the end of 2020. The ballot initiative would provide a two-year extension of the employee and business-to-business data exemptions.
Amending the ballot initiative. The bill can only be amended if the amendments further the intent and purpose of the ballot initiative, which significantly limits the potential for legislative change.
Creating Inefficiencies with Federal Privacy Law. Several of the ballot initiative’s new provisions apply to newly defined sensitive personal information. However, this same data already is regulated by federal agencies and laws (such as protected health information regulated under the Health Insurance Portability And Accountability Act), and the ballot initiative doesn’t change the CCPA’s existing exemptions.
The Silver Lining: Congress. If the ballot initiative passes, businesses will likely will need to augment the privacy programs recently established to comply with the CCPA. These efforts may take place alongside other state legislatures’ attempts to pass privacy legislation, and could create a complex regime of multiple states enacting different privacy laws. The 2023 effective date for the ballot initiative would provide Congress a defined window of time to intervene and preempt an emerging patchwork system of privacy laws. That said, it is not clear that Congress would act in a sufficiently timely way to avoid the need for companies to expend significant energy operationalizing the ballot initiative.
Tags: California, California Consumer Privacy Act (CCPA), Data Privacy, State Legislatures, United States
Alexandra Scott
Read more about Alexandra ScottEmail