On Wednesday, Californians for Consumer Privacy, the official proponent of the ballot initiative that became the California Consumer Privacy Act (“CCPA”), announced that it had filed a new voter-sponsored initiative with the California Secretary of State that will appear on the November 2020 ballot (if the requisite number of signatures can be gathered and certified). The initiative, named the “California Privacy Rights and Enforcement Act of 2020” (“CPREA”), would amend the CCPA is drastic ways, providing consumers with broad new privacy rights, and imposing strict additional obligations on businesses with respect to consumer information in California.
Rick Arney – board member of Californians for Consumer Privacy and co-author of the CCPA –said earlier this month that he regretted not taking a harder line in negotiations with lawmakers, particularly when it came to children’s privacy. CPREA contains a number of increased privacy protections for children under 16 years of age. It appears that CPREA may be designed, at least in part, to correct those perceived weaknesses in the CCPA and have the ballot fight that the CCPA avoided.
CPREA contains a host of changes that would expand the CCPA, most notably:
Add a new category of personal information to the CCPA – “sensitive personal information” – and provides for additional privacy protections and requirements regarding the collection and disclosure of sensitive personal information (which is defined to include, for example, social security numbers, financial account numbers, account credentials, geolocation data and information related to racial or ethic origin, religion or union membership).
Expand the disclosures that are required under the CCPA, including disclosures relating to any political uses of consumers’ personal information.
Require businesses to destroy personal information once the information is no longer needed for the purpose for which it was originally collected.
Limit the collection of personal information by a business to only that information that is reasonably necessary for the disclosed purpose for which information is collected (similar to GDPR).
Allow consumers to opt-out of the use of their sensitive personal information for advertising or marketing purposes.
Require opt-in consent for the collection of personal information of consumers 16-years of age or younger (currently, the CCPA only requires opt-in consent for the sale of personal information of consumers 16-years of age or younger).
Require businesses to permit consumers to correct inaccurate personal information that the business has collected about the consumer.
Require businesses to disclose how they use consumers’ personal information for political purposes.
Create the “California Privacy Protection Agency”, which will take over enforcement of California’s privacy laws from California’s Attorney General. The Agency would be required to investigate consumer complaints regarding violations.
Triple penalties under the CCPA for violations relating to the personal information of children 16 years of age or younger.
Permit amendment by the Legislature, but only if the amendments “are consistent with and further the purpose and intent of this Act.”
Business interests had some success in Sacramento this year in curtailing efforts to expand the reach and teeth of the CCPA, defeating, for example, SB 561, which would have expanded the CCPA’s private right of action to any violation of the law. If history his any guide, businesses should take CPREA very seriously, as Californians for Consumer Privacy was unwilling to compromise for business interests during the prior ballot fight. If CPREA is certified for the 2020 ballot, an expensive and extremely contentious campaign is likely. The law would take effect on January 1, 2021 if it is passed by voters.
For more detail regarding CPREA or its progress toward the 2020 ballot, contact Joseph W. Guzzetta at jwg@severson.com or 415-677-5622.