A wide-ranging new California consumer privacy law went into effect just six months ago, but some privacy advocates already want regulations to be even more stringent.
In May, Californians for Consumer Privacy submitted more than 900,000 signatures to the state to qualify its California Privacy Rights Act as a ballot initiative during the November election. One of the ballot initiative leaders is Alastair Mactaggart, a real estate developer who pushed for the original consumer privacy law.
“Even as we’ve worked to strengthen privacy laws here in California, we’ve realized that our laws need to keep pace with the ever-changing landscape of constant corporate surveillance, information gathering, and distribution,” Mactaggart, founder of Californians for Consumer Privacy, said in a statement. “We think Californians deserve to participate in and shape the conversation about how, when, and with whom our most personal information is shared.”
The ballot initiative would add new privacy rules onto the California Consumer Privacy Act, which requires covered businesses to disclose the personal information they collect, sell, and share. The act requires companies to delete personal information when a customer requests and mandates that they notify customers when they sell personal data. The act’s penalties are $2,500 per unintentional violation or $7,500 per intentional violation, with the fines assessed per customer record.
The new proposal would pump up the regulations in the act in several ways.
First, it would allow consumers to restrict a business from any use of their sensitive personal information, including Social Security numbers, driver’s license numbers, financial account information, and health information.
It would also prohibit businesses from precise tracking of their geolocations for most purposes, with “precise” defined as within about 250 acres. This would prevent a company from tracking consumers to rehab centers or medical facilities, or to find out how often they eat at fast-food restaurants, the privacy group said.
The proposal would triple the act’s fines for collecting and selling children’s information. Also, it would establish a new California Privacy Protection Agency, funded with $10 million from the state’s budget. This would give California approximately the same number of privacy enforcement staff members as the Federal Trade Commission.
Some privacy advocates applauded the effort to strengthen California’s new privacy regulations. Under the current act, businesses in the state are not required to tell consumers if they are selling their health and financial data, said Porter Adams, CEO of Disappear Digital, a privacy consulting firm.
“If a company has my personal data, I want to know about it,” Adams said. “The new ballot initiative would force companies to disclose any use of our personal information.”
Also, the new proposal would make user names and passwords sensitive information. “So, you could sue a company for a data breach immediately without waiting for identity theft,” he added.
Some critics said the ballot initiative is premature, however. A new law is not needed yet and “maybe not at all,” said Steven Gebelin of the Beverly Hills law firm Lesowitz Gebelin. The final regulations for the act aren’t yet finished, and it’s unclear what enforcing the act will look like right now. “We don’t know what the long-term impact of the regulations will be for consumer privacy or for businesses required to implement them,” Gebelin said. Many businesses adjusting to the COVID-19 pandemic are asking for more time to comply with the act, Gebelin added.
Michael Hamilton, former chief information security officer of Seattle and chief information security officer of cybersecurity vendor CI Security, called on a federal privacy law to “control the proliferation of these laws in every state.” If the California initiative passes, other states will follow suit, he predicted.
If the California privacy initiative passes, it could be challenged in court, he added. The advertising industry “would be the primary recipient of both a hit to revenue and increased regulatory scrutiny,” he said. “The increasing size of the fines is going to give a lot of people pause.”
