Veteran state Sen. Bob Hertzberg, D-Van Nuys, a CCPA co-author, talked with Techwire about the significance of CCPA-related legislation that remains active and offered advice to technology vendors.
“Fasten your seatbelt. Welcome to the California Legislature. A lot can be done at the last minute,” he said. Among the takeaways:
• As others have said, Hertzberg emphasized that the CCPA “was never intended to be a complete product at the time we passed it,” and was instead “an effort to get the initiative off the ballot,” with enforcement delayed ahead of the refinement that is now taking place. Most important, Hertzberg said, was the Legislature’s decision to not “proceed with the private right of action,” which he said “would have been horrible if that would have passed” and could have killed the CPPA. That was a reference to Senate Bill 561 from state Sen. Hannah-Beth Jackson, D-Santa Barbara, chair of the Senate Judiciary Committee, which was sponsored by Attorney General Xavier Becerra.
SB 561 would have removed “an onerous requirement to provide legal opinions directly to any business or third party, which would unnecessarily divert public funds and resources from enforcement,” according to a news release from Jackson’s office; and would have eliminated the attorney general’s 30-day notice requirement before taking action — “essentially a ‘get-out-of-jail-free card’ for bad actors.”
Hertzberg’s press secretary, Katie Hanzlik, said via email that “adding a private right of action could be seen as going back on the agreement that was made between all parties at the CCPA negotiating table.”
• The CCPA bars a business from requiring a consumer to create an account with it in order to make a verifiable consumer request. Assembly Bill 25, from Assemblyman Ed Chau, D-Monterey Park, would create an exception by letting businesses require “authentication of the consumer that is reasonable in light of the nature of the personal information requested in order to make a verifiable consumer request.” But it would also let a business require consumers to submit verifiable requests through an account they maintain with the business — if the consumer maintains an account with that business. A co-sponsor of the bill, Hertzberg said its one-year duration should seriously blunt its effectiveness.
• AB 846, introduced by Assemblywoman Autumn Burke, D-Inglewood, and other legislators, would create an exemption allowing companies to sell consumer data in exchange for customer loyalty rewards. Hertzberg said there’s “a good argument” on loyalty rewards and he doesn’t have a problem with it “as long as you’re not sharing the data with everybody else and the customer knows they’re getting a benefit and understands exactly what happens.”
• AB 1564, from Marc Berman, D-Palo Alto, would eliminate the requirement that companies provide a toll-free telephone number for consumers to submit disclosure requests, allowing them to offer an email address instead. Hertzberg said the challenge for legislators is to build a “structure” to enhance consumer protection that can account for the “rapid rate of change” in privacy as new consumer technologies emerge. All three bills are now before the Committee on Appropriations.
• The assemblyman said a larger discussion about privacy is developing, driven in part by the CCPA — but also by information and the “ability to commoditize something that looks like it’s valueless, and make people very, very rich” — and he encouraged the private sector to take part.
“Across the board, vendors need to think differently about how they approach their businesses. Disruption for disruption’s sake is something that is important, but you’ve got to have a deeper think. There’s stakeholders and consequences, and if they don’t think about it, government’s going to think about it for them and that’s not good,” Hertzberg said.
• Having held a series of forums earlier this year to get feedback on the CCPA, the Attorney General’s Office is in the midst of the rule-making process that will ultimately shape the law, a spokesperson said.
