On April 9, 2019, the California State Senate Standing Committee on the Judiciary held a hearing on Senate Bill 561. As followers of this ‘blog know, SB 561, introduced by Senator Hannah-Beth Jackson, a Democrat from Santa Barbara, and requested and sponsored by the California Attorney General, would provide for a private right of action for any violation of the California Consumer Privacy Act of 2018 (“CCPA”) (as opposed to only providing a private right of action for cybersecurity breaches, without regard to the CCPA’s other enumerated rights), would eliminate the 30-day right to cure in the CCPA before a lawsuit can be filed, and would eliminate the right of businesses to seek the opinion of the California AG on issues related to CCPA compliance.
First, the bad news: SB 561 was passed from the Senate Judiciary Committee with a “Do Pass” recommendation as currently drafted. The vote was 6-2, with Vice-Chair Andreas Borgeas (R – Fresno), the Committee’s sole Republican, being joined by Senator Bob Wieckowski (D – Fremont) as the only dissenting votes. Its next stop will be the Senate Appropriations Committee. If passed there, it will advance to the Senate floor for a vote.
But now, maybe some silver lining: Almost all of the Senate Judiciary Committee’s members, including almost every Democrat on the Committee, expressed serious concerns with the current state of the bill — although, apparently not enough reservations that prevented them from voting it forward without amendment. Senator Thomas J. Umberg (D – Santa Ana) grilled Senator Jackson and the representatives of the Attorney General’s office, focusing at first on the right to cure and what appeared to be some uncertainty regarding its meaning and the effect of the proposed bill, but then moving forward to suggest that enforcement by the Attorney General, County District Attorneys and city attorneys under California Business and Professions Code Section 17200 may be preferable to a private right of action. In response, Senator Jackson and the representatives from the Attorney General’s office committed to exploring alternative means of enforcement as the bill advances in the Senate. But, that commitment and $3.25 will buy you a cup of coffee.
Senator Anna M. Caballero (D – Salinas) went next, voicing “grave” concerns about the effect of SB 561 on businesses in California. She noted particularly a fear among many that the CCPA as a whole will have a tendency to drive businesses – particularly small businesses and start-ups – out of California. Senator Bill Monning (D – Carmel) suggested that different tiers of enforcement be created based on the size of businesses affected by the CCPA. After noting that the Legislature should listen to the Attorney General, who previously stated that his office lacks the resources and manpower to enforce the CCPA effectively, Senator Monning suggested differing levels of damages based on the size of the business at issue. He also suggested that differing levels of damage or enforcement mechanisms could be assigned to different types of breaches. While he provided no specifics, he suggested amendments to SB 561 that would treat technical or ministerial violations of the act differently from more serious violations (such as selling a customer’s personal information after the customer exercised his or her right to opt-out under the CCPA).
Senator Benjamin Allen (D – Redondo Beach) had what seemed to be the best-received (among the rest of the Committee, anyway) criticism of SB 561. Observing that the lack of a private right of action was the result of a deal struck with business advocates to get the CCPA passed in the first place, he suggested that adding a private right of action now would threaten the ability of the Legislature to make compromises in the future. “I am sensing a great deal of trepidation on this Committee when it comes to unwinding that deal,” he said.
Senator Borgeas, the Committee’s sole Republican, also sharply criticized Senator Jackson’s attempt to belatedly add a private right of action to the CCPA. Senator Borgeas echoed the statements of Senator Allen regarding the bargain that the Legislature struck in 2018. He specifically requested that Senator Jackson not attempt to move SB 561 forward at the hearing, and asked her to return during the Committee’s next meeting in two weeks and present a revised version of the bill.
Senator Jackson rejected these calls, noting that it was her intention to “move this bill forward today.” She stated that she did not believe that a private right of action would create the “class action bonanza” that business leaders have warned about. “I do not share the concern that this bill will be red meat and that the courthouse doors will fly open,” she stated. Nonetheless, Senator Jackson committed to working with business interests and Republicans to revise SB 561, but she stated that she viewed the current enforcement mechanisms in the CCPA as inadequate. “A right without a remedy is no right at all,” she said. (This echoed the Attorney General’s earlier comments, as retold in the Senate Judiciary Committee’s Analysis issued on Monday, that “[t]here is something unfair about giving California’s consumers new rights but denying them the ability to protect themselves if those rights are violated.”) Other Committee Democrats largely echoed the sentiments of their fellow Committee-members, in particular expressing concern about unwinding an already-struck bargain and burdening small businesses with endless litigation. Ultimately, however, Senator Jackson insisted on a vote on SB 561 in its current form. Senator Caballero moved that the Committee advance the bill with a “Do Pass” recommendation, but noted that “if [the bill] continues in this condition, then unequivocally, I will be a no.” With that, the Committee advanced the bill to the Senate Appropriations Committee by a vote of 6-2.
Before yesterday’s hearing, SB 561, with its backing by the Attorney General, appeared a frontrunner in the race to amend the CCPA. (Our write-up on other competing amendments can be found here: [link].) However, with even Democratic Senators expressing concerns, and Senator Caballero going so far as to say she would not support the bill if it came to the floor in its current form, a private right of action now seems less of a foregone conclusion. SB 561 will nevertheless move forward to the Senate Appropriations Committee as drafted. As Senator Borgeas noted, many Senators have committed to reworking legislation in committee, only to have those bills pass as they were written when advanced out of committee. So, while a private right of action is not as likely as it was on Monday, businesses should move forward with their CCPA compliance,assuming that they may be subject to lawsuits for noncompliance and can no longer rely on the 30-day right to cure or free legal advice from the Attorney General, once the law goes into effect.