Numerous Amendments To The California Consumer Privacy Act (“CCPA”) Pass Assembly Committee on Privacy and Consumer Protection

On April 23, 2019, the California Assembly’s Committee on Privacy and Consumer Protection (the “Committee”) held a whirlwind, three-hour hearing on 40 pending bills, including numerous bills that relate to consumer privacy and amend the California Consumer Privacy Act of 2018 (the “CCPA”). With a deadline of April 26 for the Committee to report fiscal bills and a deadline of May 3 to report non-fiscal bills out of the Committee, the marathon session considered bills that would make numerous changes to the CCPA (including many changes that would clarify, for the better, the new privacy law).  All of the privacy bills were reported out of the Committee with a “do pass” recommendation.

As we noted yesterday, the session began with good news from Chairman Ed Chau (D – Monterey Park), who announced that Assemblywoman and Committee member Buffy Wicks (D – Oakland) had withdrawn Assembly Bill 1760, the “Privacy for All Act of 2019”, a draconian law that would have severely increased the regulatory and litigation burden on businesses in California.

The hearing began with a presentation by Assemblyman Tom Daly (D – Santa Ana) on his bill, Assembly Bill 981. AB 981 exempts insurers from the reach of the CCPA.  As noted by Assemblyman Daly at the hearing, insurance companies have traditionally been regulated by the Insurance Commissioner, including with respect to privacy-related matters.  Privacy advocates strongly opposed the exempting of insurance companies from the CCPA, but the Committee still passed AB 981 by a vote of 6-0, with 2 abstentions.

The Committee next considered Assembly Bill 873, authored by Assemblywoman Jacqui Irwin (D – Thousand Oaks), which would add the word “reasonably” in front of the phrase “is capable of being associated with” in the definition of “personal information” in the CCPA, and would revise and clarify the definition of “deidentified information”. As with AB 981, AB 873 was also strongly opposed by privacy advocates such as the ACLU, which opposed any changes to the “capable of being associated with” language in the definition of “personal information” in the CCPA.  Despite the opposition, however, the bill passed the Committee by a vote of 9-0.

Another bill authored by Assemblywoman Irwin was then heard – Assembly Bill 874 – which would adjust the definition of “publicly available information” in the CCPA to remove the requirement that publicly available information is only exempted from the definition of “personal information” if the information is used consistent with the purposes for which it was collected by the government agency that compiled the information. Assemblywoman Irwin noted the potential First Amendment problems with such restrictions on the use of publicly available information.  No opposition was registered.  The Committee passed that bill by a vote of 10-0.

The Committee next heard Assembly Bill 846, authored by Assemblywoman Autumn Burke (D – Marina del Rey), which would exempt customer loyalty programs from the prohibitions in the CCPA relating to making payments to consumers in exchange for not exercising their rights under the CCPA (the “non-discrimination provision” in the CCPA). The bill received strong opposition from privacy advocates – including Californians for Consumer Privacy and its founder, Alistair McTaggart (an official proponent of the ballot initiative that became the CCPA), who said he considered the bill unnecessary and did not believe the CCPA affected customer loyalty programs at all.  Many opponents noted that they would be open to supporting the bill if changes were made.  Notwithstanding the opposition, the Committee passed the bill by a vote of 8-0.

While not directly related to the CCPA, the Committee then heard Assembly Bill 1138, authored by Assemblyman James Gallagher (R – Yuba City), which would prohibit social media platforms from permitting children under the age of 13 (amended at the hearing with the consent of Assemblyman Gallagher from the age of 16) to create accounts on those platforms without the consent of the child’s parents. That bill had broad support and passed 8-0.

Two bills authored by Assemblyman Marc Berman (D – Palo Alto) were then heard. The first, Assembly Bill 1146, would exempt warranty-related information shared between new car manufacturers and dealers, from the CCPA’s purview.  That bill passed the Committee 7-0.  The second, Assembly Bill 1564, would require that businesses must provide either a designated toll-free telephone number or a designated website address and physical address for the submission of verifiable consumer requests under the CCPA.  The bill also passed the Committee by a 7-0 vote.

The Committee then moved on to Assembly Bill 25, authored by Chairman Chau. AB 25 is a much-needed clarification that would provide that employment-related information collected by employers about their employees and independent contractors is not “personal information” subject to the CCPA (and, in particular, the CCPA’s right to be forgotten, which critics warned could require businesses to delete information about sexual harassment and other complaints about employees on a demand by those employees).  Alistair McTaggart opposed almost every privacy bill considered at the hearing, but expressed mild support for AB 25, noting that while his organization, Californians for Consumer Privacy officially took no position on the bill, it was time to “put this issue to bed.”  The bill passed 7-0.

Privacy advocates, including the ACLU and the Electronic Frontier Foundation, strongly criticized the Committee in advance of Tuesday’s hearing, claiming that the Committee would only hear bills advocated by business interests that “weakened” the CCPA. The Committee, they suggested, has decided not to strengthen the CCPA by passing bills like the Privacy for All Act, and instead folded to business interests.  But as detailed above, a look at the content of the bills that the Committee considered reveals that they are largely clarifying, addressing long-standing and well-known ambiguities in the CCPA.

A handful of CCPA-related bills will be heard by the Committee at its next hearing on April 30. In addition, Senate Bill 561 authored by Senator Hannah-Beth Jackson (D – Santa Barbara), which would add a full private right of action to the CCPA and would eliminate the 30-day safe harbor, is also set for hearing before the Senate Appropriations Committee on April 29.  That bill remains in its original form – with no amendments – despite repeated commitments from Senator Jackson at the Senate Judiciary Committee hearing to work with business interests to consider changes almost a month ago.

With the upcoming deadlines, there will be a flurry of activity in the coming weeks on bills related to the CCPA. We’ll keep you informed of the progress of that proposed legislation on this ‘blog.