California Attorney General Confirms Regulations Coming in October
On Tuesday evening, the privacy advocate and real estate investor who initially qualified the California Consumer Privacy Act (CCPA) for the November 2018 ballot, Alastair Mactaggart, announced that he would seek to qualify a new consumer privacy initiative for California’s November 2020 ballot.
Mactaggart discussed his new proposal—referred to as the California Privacy Rights and Enforcement Act of 2020—at an industry conference this morning. Describing the measure as “new rights in response to new technology,” Mactaggart said the measure would ensure consumers greater control over “sensitive personal information” such as race, health, sexual orientation and geolocation data than is provided under current law. He also noted the new measure would mandate a new opt-in requirement for certain data collection, require the disclosure of algorithms used to profile individual consumers, and establish a dedicated California agency to enforce privacy protections and issue regulations. The California Privacy Protection Agency would be overseen by a five-member board appointed by the governor, legislative leadership and the attorney general. The agency would be funded from fines on companies that violate the act. The new measure is to take effect January 1, 2021, if passed by voters.
This 2020 measure comes on the heels of two years of intense legislative negotiation over the meaning and breadth of the CCPA, widely regarded as the strongest privacy protection law in the U.S. Mactaggart reportedly spent over $3 million of his own money to qualify the original CCPA for the ballot in 2018, but ultimately withdrew the measure after reaching a compromise with legislative leaders and the Brown administration to enact the CCPA legislatively last summer.
Mactaggart told the audience not to expect a legislative alternative to his proposed 2020 initiative. He views the CCPA as a floor for consumer privacy protection and wants the 2020 initiative to lock in those protections while also adding new protections. He described watching the 2019 legislative process and seeing the countless hours and the effort spent to clarify, change and sometimes weaken the CCPA’s provisions before it takes effect January 1, 2020. Although the legislature either rejected or failed to act on the vast majority of the proposed changes, Mactaggart saw the process as evidence that he needs to have voters lock in the CCPA’s current protections via a ballot initiative, thus overriding any legislative efforts to weaken it.
Mactaggart plans to file the measure this afternoon and must gather more than 620,000 signatures to place the initiative on the November 2020 ballot. He expects broad opposition from the business community, but expresses poll-driven optimism that the new measure will be adopted by California’s voters. If approved, the new measure is to take effect January 1, 2021.
Read the proposed California Privacy Rights and Enforcement Act of 2020 here.
At the same industry event, California Deputy Attorney General Stacey Schesser confirmed the office will publish draft regulations in October and final rules by the end of the 2019. The public will have 45 days to submit comments upon the release of the draft regulations. Manatt’s California government and privacy and data security teams will continue to update you on CCPA developments as we head toward the effective date.
Additional Resources: