On Wednesday, February 20, 2019, Stacey D. Schesser, the Supervising Deputy Attorney General for California Attorney General Xavier Becerra’s Privacy Unit of the Consumer Law Section, spoke to the Committee on Privacy and Consumer Protection of the California State Assembly, which is examining potential amendments to the California Consumer Privacy Act of 2018 (the “CCPA”), California’s sweeping consumer privacy law enacted in June of 2018. In those discussions, Ms. Schesser rejected calls by business advocates, including the California Chamber of Commerce, to soften some of the more onerous parts of the CCPA, and instead asked lawmakers to expand the rights of consumers to sue businesses for violations.
Specifically, Ms. Schesser asked lawmakers to amend Section 3 of the CCPA (California Civil Code Section 1798.150), which currently permits individual consumers to bring private lawsuits against businesses only for data breaches that result from the failure of a business to implement reasonable safeguards against unauthorized access to consumer information. As currently written, all other violations of the CCPA may only be enforced by the California Attorney General. Ms. Schesser stated that the Office of the Attorney General lacks the capacity to effectively enforce the CCPA, stating that the law imposes “unworkable obligations” on the office, and asked lawmakers to expand the private right of action in the CCPA to allow consumers to file private lawsuits against businesses for any violation of the law.
Private rights of action provide a critical adjunct to government enforcement, and they ensure that consumers can assert their rights and seek appropriate remedies,” Schesser said. “The Attorney General urges you to expand the CCPA private right of action to include violations of the key rights provided by this Act.
Ms. Schesser also asked lawmakers to eliminate the 30-day right of businesses to cure violations of the CCPA before any lawsuit can be filed, which is enshrined in California Civil Code Section 1798.150(b).
According to Ms. Schesser, “this would essentially be a get out of jail free card.” She stated, “the CCPA’s right to cure would allow even the worst offenders to receive a pass rather than allowing the Attorney General to use his prosecutorial discretion in enforcing the law.” Ms. Schesser urged the Committee to amend the CCPA to eliminate the right to cure (and with it the right of businesses to seek the opinion of the California Attorney General regarding compliance with the law).
Finally, Ms. Schesser suggested that the California Attorney General may not be able to meet the July 1, 2020 deadline for issuing interpretive regulations set in the CCPA, particularly if the Legislature further amends the CCPA during this legislative session. She stated that the Attorney General will not actually begin the formal rulemaking process until the Fall of 2019.
A full private right of action for violations of the highly-technical CCPA would be a major blow to businesses, and in the words of Sarah Boot, a lobbyist for the Chamber of Commerce, “would be devastating for California’s businesses and for our economy” and “would be a class action bonanza.” While no proposed legislation has yet been introduced to amend the CCPA this legislative session, Assemblyman Chau (D – Monterey Park) and Senators Dodd (D – Napa) and Hertzberg (D – Van Nuys) have introduced Assembly Bill 25, which is a placeholder bill for amendments to the CCPA. Currently, AB 25 is blank, but businesses should keep a close watch on its progress this year.
For more information on the California Consumer Privacy Act, or on the progress of Assembly Bill 25 and other proposed amendments to the CCPA, please contact Joseph W. Guzzetta at 415-677-5622 or jwg@severson.com.