In late April, the California state legislature's Privacy and Consumer Protection Committee held hearings on nine bills that seek to refine the California Consumer Privacy Act of 2018 ("CCPA") by clarifying the legislation and limiting its scope. Eight bills advanced to the Assembly Appropriations Committee; the ninth is non-fiscal and will next be heard by the full Assembly. Last week, the California Assembly Appropriations Committee approved three of the bills. These bills, now on the Assembly's "Consent Calendar," will be heard this week. The Appropriations Committee will hold hearings on the other five bills in the next two weeks.
From the Assembly's Appropriations Committee, bills must go through the full Assembly, the California Senate and the California governor to be enacted as law.
Key aspects of these bills are summarized below.
- AB 25: would exempt a
person's personal information only to the extent that their
personal information is collected and used solely within their
employee role (or similar roles within the employment context).
- Status: on the Assembly's Consent Calendar
- AB 846: would provide that the
CCPA's discrimination prohibition does not apply if the
business's differential treatment of a consumer is in
connection with the consumer's voluntary participation in a
loyalty, rewards, premium features, discount, or club card program,
or in connection with a specific good/service whose functionality
is directly related to the collection, use, or sale of the
consumer's data.
- Status: pending before the Appropriations Committee
- AB 873: proposes changes
including specifying that "personal information" does not
cover all "information that is…capable of being
associated" with a particular individual or household, but
instead information that "reasonably capable of being [so]
associated." This bill also would revise the definition of
"deidentified."
- Status: pending before the Appropriations Committee
- AB 874: would create a clear
and full public record exemption from the definition of
"personal information." This bill also would clarify that
"personal information" does not include consumer
information that is deidentified or aggregate consumer information.
- Status: on the Assembly's Consent Calendar
- AB 981: would add privacy
requirements to the California Insurance Information and Privacy
Protection Act ("IIPPA") to reflect the CCPA and would
eliminate a consumer's right to request that a business delete
or not sell personal information under the CCPA if it is necessary
to retain or share the personal information to complete an
insurance transaction requested by the consumer.
- Status: pending before the Appropriations Committee
- AB 1146: would exempt from the
CCPA certain vehicle information shared between a new motor vehicle
dealer and specified parties.
- Status: pending before the Appropriations Committee
- AB 1355: would amend the CCPA
to exclude consumer information that is deidentified or aggregate
consumer information from the definition of "personal
information." The bill also clarifies that (1) a
consumer's right to request "specific pieces" of
personal information must be disclosed in the business's online
privacy policy or policies, rather than a list of the specific
pieces of personal information collected and (2) opt-in consent is
required to sell the personal information of children less than 16
years of age (not including children who are 16 years of age).
- Status: on the Assembly's Consent Calendar
- AB 1416: would add that the
CCPA shall not restrict a business's ability to do the
following (1) comply with any rules or regulations (in addition to
federal, state or local laws), (2) share personal information with
a government agency solely for the purposes of carrying out a
government program (if certain conditions are met) or (3) sell the
personal information of consumers who have opted out of sale for
the sole purpose of detecting security incidents, protecting
against malicious, deceptive, fraudulent, or illegal activity and
prosecuting those responsible for that activity (provided that the
business or person to whom it is sold does not further sell that
information for any other purpose).
- Status: approved by Privacy and Consumer Protection Committee; date for hearing on the floor to be announced
- AB 1564: requires businesses to
make available, in a reasonably accessible form to consumers, a
toll-free telephone number or an email address and a physical
address for submitting requests for information required to be
disclosed under the law. (Online-only businesses need only provide
an email address.) If a business maintains a website, the bill
requires the business to make the website address available to
consumers to submit requests for information.
- Status: pending before the Appropriations Committee
Separately, the Senate Judiciary Committee has approved SB 561, which would add a private right of action for all violations of the CCPA. SB 561 also would remove provisions in the CCPA that (1) authorize the California Department of Justice to provide compliance guidance to individual businesses or third parties and (2) provide a 30-day cure period for enforcement actions brought by the California Attorney General. SB 561 is supported by Attorney General Xavier Becerra. This bill is currently pending before the Appropriations Committee.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.