When first introduced on February 22, 2019, AB 1760 aimed to merely fix a few typographical errors in the California Consumer Privacy Act of 2018 (the “CCPA”). However, when AB 1760 was first amended on April 4, 2019, the bill turned into a wholesale replacement of the CCPA with the “Privacy For All Act of 2019.” The Privacy For All Act of 2019, introduced by Assembly member Buffy Wicks (D-Oakland), builds on the framework of the CCPA, but changes it in several important ways. One of the most notable changes is the requirement that a business obtain an individual’s opt-in consent in order to share personal information collected about a consumer. Second, the bill creates a private right of action for any violation of the bill. The bill also makes changes to what business can do with the data they collect: business can only collect personal information for one of three reasons:
-
if reasonably necessary to provide a service or conduct an activity that a consumer has requested,
-
as reasonably necessary for security or fraud prevention, or
-
as required to comply with a court order or legal process.
Additionally, under the bill, businesses would only be able to retain data if reasonably necessary to provide a service or conduct an activity requested by the consumer. This means that once a business is done with the original purpose for the collecting the data, it would be required to delete it even without a customer’s request for deletion.
On April 12, 2019, the Committee on Privacy and Consumer Protection removed the provision in AB 1760 that would establish a private right of action for any violation of the proposed statute expanding the private right of action to apply to any violation. The bill will remain with the Assembly’s Committee for Privacy and Consumer Protection for further consideration.
Another notable proposed amendment to the CCPA is AB 25. This bill was introduced by Assembly member Ed Chau, the CCPA’s leading Assembly sponsor last year, and coauthored by Senators Dodd and Hertzberg, the California senators who introduced the CCPA alongside Assembly member Chau. AB 25 proposes an amendment to CCPA that would expressly exclude employees from the definition of a “consumer” under the CCPA. As it currently stands, the definition of “consumer” under the CCPA is broadly defined as California residents. This amendment seeks to exclude employees from that definition by creating a carve-out for a “natural person whose personal information has been collected by a business in the course of a person acting as a job applicant or as an employee, contractor, or agent, on behalf of the business, to the extent their personal information is used for purposes compatible with the context of that person’s activities for the business as a job applicant, employee, contractor, or agent of the business.” This bill has also been referred to the Committee on Privacy and Consumer Protection for consideration.
We will continue to monitor these and other notable amendments to the CCPA and will provide updates as we move closer to January 1, 2020.
[View source.]
