The California Consumer Privacy Act ("CCPA") was put together quickly (in approximately one week) as a political compromise to preempt a proposed privacy ballot initiative that contained a number of problematic provisions. (For more on the history of the CCPA, you can find a timeline on page 2 of BCLP’s Practical Guide to the CCPA). Given its hasty drafting there were a number of areas in which the act was at best ambiguous; at worst it would lead to unintended results.
Since its passage there have been more than fifteen proposed amendments to the CCPA. Some of those proposals would impose further regulatory and administrative burdens on business; other proposals have sought to clarify ambiguities and address business impracticalities. On August 31, 2018, the California legislature passed the first amendment to the Act in the form of Senate Bill 1121. Last week an additional six amendments passed the legislature. While some of those amendments marginally improve the Act, there remain a great number of problems with the statute. In addition, there has been a large number of misreports concerning the scope and import of the amendments.
While the following provides a summary of each amendment, BCLP will be publishing a series of frequently asked questions that address how the amendments impact compliance with the Act.
Summary of the Amendments to the CCPA
|
Date Enacted
|
Bill Number
|
Subject
|
Business Impact
|
Description
|
|
2018-08-311
|
SB 1121
|
Introduced additional exemptions
|
Improvement
|
The amendment introduced, and/or expanded, a series of exemptions to the CCPA including:
· A partial exemption for financial institutions regulated by the Gramm Leach Bliley Act,
· An exemption for data collected pursuant to the Driver’s Privacy Protection Act,
· An exemption for information governed by the Health Insurance Portability and Accountability Act.
The amendment further clarified that conflicting federal and state laws trump the CCPA.
The amendment removed the requirement that a plaintiff need inform the Attorney General prior to bringing suit.
The bill clarified the limited scope of the private right of action.
The bill limited the civil penalty that could be sought by the Attorney General.
The bill revised timelines concerning regulations to be promulgated by the Attorney General.
|
|
2018-09-122
|
AB 874
|
Modifies definitions including definition of “personal information”
|
Marginal Improvement
|
The amendment modified the definition of “personal information” to (i) add the term “reasonably” to the requirement that “personal information” be capable of being associated with or linked to an individual or household, both generally and in reference to a particular enumerated category; (ii) amend an exception to the definition of “personal information” for publicly available information by removing certain conditions on the exception related to “compatible” uses of data; and (iii) exempt aggregate and deidentified consumer information from the definition of personal information.
The amendment further confirmed that “deidentified or aggregate consumer information” is exempt from the definition of “personal information.” Both “aggregate consumer information” and “deidentified” are separately defined in section 1798.140.
Finally, the amendment made a number of non-substantive technical changes to various definitions in section 1798.140.
|
|
2018-09-133
|
AB 25
|
Delays effective date until 1.1.2021 for “personal information” collected in the context of employment relationships for most requirements of the statute
|
Significant Improvement
|
The amendment delays the effective date until January 1, 2021 of many requirements of the statute for personal information collected by the business from job applicants, employees, owners, directors, officers, medical staff members, or contractors (collectively referred to as “employees” for purposes of this summary) provided the information (i) is used solely within the contexts of those roles and (ii) is necessary for the administration of benefits. Section 1798.145(g)
The amendment does not delay the effective date when a business must notify employees of the business’s privacy practices. Specifically a business must still notify an “employee” “at or before the point of collection of categories of personal information to be collected and the purposes for which the categories of personal information will be used.” Section 1798.100(b). Once notification to the employee is provided, a business cannot expand the categories of personal information collected about the individual without their consent. Section 1798.100(b)
The amendment does not delay an employee’s right to sue in the event of a data breach involving their unencrypted or un-redacted information. Section 1798.150.
|
|
2018-09-134
|
AB 1355
|
Financial incentive programs
|
Marginal Improvement
|
The amendment allows a business to treat consumers differently depending upon whether they exercise a privacy right, if the differential treatment is reasonably related to the value provided to the business by the consumer’s data.
The amendment clarified some of the ambiguous language contained in the original version of the CCPA around the private right of action.
The amendment expands and clarifies the exemption provided to consumer reporting agencies that are governed by the Fair Credit Reporting Act.
The amendment temporarily delays the application of the CCPA to information collected from some business contacts.
The amendment further clarifies that de-identified or aggregated information is exempt.
|
|
2018-09-145
|
AB 1202
|
Requires “data brokers” to register with the Attorney General’s office
|
Marginal Detriment
|
The bill requires “data brokers,” a term which is defined to include companies that sell personal information and do not have a direct relationship with a consumer, to register and pay a fee with the Attorney General. The Attorney General will in turn create an online directory of the registered data brokers.
|
|
2018-09-122
|
AB 1146
|
Creates a narrow exception that allows new motor vehicle dealers to share vehicle and vehicle ownership information with the original manufacturer for the exclusive purposes of warranty or recall-related repairs.
|
Improvement
|
The amendment creates an exception to the consumer opt-out right and gives new motor vehicle dealers the ability to share vehicle information and vehicle ownership information with the original manufacturer of the vehicle. This exception may only be exercised for the purposes of anticipating or carrying out a warranty or recall-related repair.
The exception is limited to “new motor vehicle dealers” which include dealers that acquire for resale (1) new and unregistered motor vehicles, (2) new off-highways motorcycles, or (3) new off-highway all-terrain vehicles. Although used car dealers are not covered, used cars sold by a new motor vehicle dealer are not excluded.
|
1. Approved by the Governor on September 23, 2018.
2. Pending approval by the Governor.
3. Pending approval by the Governor.
4. Pending approval by the Governor.
5. Pending approval by the Governor.
[View source.]
