And sure enough, Big Tech is sharing plenty of anxiety.
A year later, lawmakers have considered a handful of industry-backed bills that consumer groups said would weaken the privacy protections. So far, consumer advocates say the bills they considered most troubling have failed to advance while others have been amended.
“As it stands right now,” said legislative activist Hayley Tsukayama of the Electronic Frontier Foundation, the Consumer Privacy Act protections “will be mostly the same bill that goes into effect.”
Sponsored by advocacy group Common Sense, the law will give consumers the right to know what data is collected on them, the chance to opt out of collection and to hold companies accountable for unauthorized release of their information.
It comes amid a shifting landscape for technology companies accustomed to a light touch from deferential lawmakers fearful of stifling innovation.
Facebook agreed this month to a record $5 billion penalty in a settlement with the Federal Trade Commission over privacy breaches and promised to change how it operates and handles user information. The social network last year apologized for revelations that political consulting firm Cambridge Analytica had harvested up to 87 million Facebook user profiles without their consent. Other companies last year also drew outrage over revelations of massive data breaches, including Uber, Yahoo and Equifax.
California’s Privacy Act passed unanimously out of the Legislature in 2018 when then-Governor Jerry Brown signed it into law. It was supported by Alastair Mactaggart, a San Francisco real estate developer who had launched an initiative under the same name that qualified for the November 2018 ballot.
Mactaggart agreed to withdraw the initiative, which the technology industry said went too far, after lawmakers approved the Privacy Act. Lawmakers said passing the protections as a bill would allow them to approve tweaks to address concerns without having to go back to voters.
TechNet, a technology industry trade group whose members include Silicon Valley giants Google and Facebook, said after the law’s approval that it was “critical that the business community, consumer groups, and the Legislature work together over the next 18 months to improve this law.”
And the group is still seeking changes after several industry-backed bills failed to advance or were amended in committee this month.
TechNet Executive Director for California Courtney Jensen said “meaningful clarifications” are “still necessary to ensure businesses can comply with this new, extensive law, and consumers can still access the products and services they expect.”
“TechNet believes the law, in its current form, will have unintended consequences on the many California small businesses and startups it will impact,” Jensen said. “Legislation moving forward does not yet address many of the consequences highlighted by the business community at the start of this legislative session.”
Among the proposed changes was AB 1416, which would let companies continue freely sharing consumers’ information with government agencies, and which consumer groups considered a major privacy threat.
Business groups and local governments argued the bill was needed to prevent the privacy law from impeding government efforts to collect child support, find people exposed to infectious diseases, locate foster children’s family members, determine social service eligibility and collect delinquent taxes and judgments.
But Tsukayama said it “would have created an enormous loophole that would have allowed any company that sells or shares information to the government the ability to ignore your privacy rights.” The bill’s author, Assemblyman Ken Cooley, D-Rancho Cordova, canceled a scheduled July hearing on the legislation.
Another bill that raised consumer advocates’ hackles, AB 873, would narrow the definition of “personal information” protected under the act.
Business groups sponsored the bill to address concerns that the definition is too broad and burdensome. The bill, by Assemblywoman Jacqui Irwin, D-Camarillo, failed to pass its initial state Senate committee hearing.
Bills that have advanced include AB 1564 by Marc Berman, D-Los Altos. It would eliminate a Privacy Act requirement that companies provide a toll-free phone number for consumers to access information about what is collected on them. It passed out of committee with amendments.
Another bill that advanced, AB 846, by Assemblywoman Autumn Burke, D-Inglewood, aims to ensure that customer loyalty programs don’t become a casualty of the privacy act’s provisions barring companies from charging customers more money for exercising their privacy rights.
Consumer advocates say the act already exempts loyalty programs and that the retailer-sponsored bill would give businesses more power to force consumers to pay for their privacy rights. It passed out of committee with amendments.
Assembly Bill 25 by Assemblyman Ed Chau, D-Monterey Park and the Privacy Act’s co-author, would clarify that its definition of “consumer” does not include an employee acting within the scope of their job. It passed out of committee with amendments, including a one-year sunset that eased privacy advocates’ concerns that it would invite intrusive data collection on employees.
A pair of bills that consumer advocates said would have strengthened the privacy protections also failed to advance. But Tsukayama said consumer advocates were grateful to the Senate Judiciary Committee where the five industry-backed bills were heard earlier this month “for blocking efforts to weaken the state’s baseline privacy protections.”
TechNet’s Jensen said the industry “is strongly committed to our work with the Legislature and consumer groups to make CCPA work for consumers, businesses, and the California economy.”
(c)2019 the San Jose Mercury News. Distributed by Tribune Content Agency, LLC.
