In August, on the last day for the California Legislature to pass bills, it passed Senate Bill 1121 to revise the California Consumer Privacy Act of 2018 (CCPA). The CCPA was signed into law in June 2018 and, unless amended, will be effective Jan. 1, 2020. While the CCPA is the most far-reaching consumer privacy and data protection measure in the United States, it was a quickly enacted compromise to prevent an even stricter initiative from appearing on the November ballot. Since its enactment, however, a broad range of stakeholders—including California Attorney General Xavier Becerra (AG), consumer groups and ad industry groups, as we previously reported—have spoken out against the CCPA.
SB 1121 was passed on Aug. 31, 2018, primarily to address so-called technical issues with the CCPA. The governor must sign or veto the bill by Sept. 30, 2018. If signed into law, SB 1121 would, among other things:
- Shift the AG’s deadline to issue regulations to July 1, 2020
- Delay enforcement of the CCPA until six months after the regulations are final or July 1, 2020, whichever is sooner
- Remove the requirement that consumers notify the AG before bringing a private action
- Limit the circumstances under which a private cause of action may be filed to breaches, as specified in 1798.150(a)
- Cap civil penalties at $2,500 for each violation and only allow civil penalties of up to $7,500 for each intentional violation
- Clarify that the examples of “personal information” included are applicable only if that information “identifies, relates to, describes or is capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household”
- Expand the exemption for medical information and protected health information (PHI) to include not only entities covered by the Confidentiality of Medical Information Act (CMIA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), but also their business associates
- Broaden the exemption for CMIA- and HIPAA-covered entities to include patient information maintained in the same manner as medical information or PHI
- Exempt information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects and collected pursuant to specified clinical practice guidelines
- Revise the CCPA so that it is inapplicable to information collected under the Gramm-Leach-Bliley Act and Driver’s Privacy Protection Act of 1994, even if the CCPA does not conflict with those acts
- Add a carve-out for information collected under the California Financial Information Privacy Act
- Render the CCPA inapplicable to the extent that it “infringe[s] on the noncommercial activities of a person or entity” described in the portion of the California Constitution addressing freedom of the press
- Explain that local lawmaking is pre-empted as of the effective date that SB 1121 is enacted and not as of 2020 when the CCPA goes into effect
- Remove the formula for allocation of penalties and settlements and instead provide that all funds be deposited into the Consumer Privacy Fund to offset costs incurred by the courts and the AG
Why it matters: While groups on both sides still take issue with the CCPA, these amendments are notable because they clarify some of the CCPA’s ambiguities—in particular, the clarification to the examples of “personal information.” While the definition remains very broad, the amendments would impose some limits that do not exist in the current law and add several additional carve-outs for personal information collected under certain existing California laws. Additionally, the removal of the AG’s role as gatekeeper for parties to file private actions would speed up the rate at which private actions are filed. As the AG explained in his letter expressing concerns about the CCPA, the need for private parties to notify the attorney general would impose additional personnel and administrative costs on the AG. This additional burden without additional resources would therefore also impede the AG’s ability to pursue its own cases as quickly. The California Legislature is likely to consider additional changes when it reconvenes for the 2019 session. Accordingly, those interested in further changes to the CCPA should continue to monitor SB 1121’s progress and participate in the legislative process to promote additional revisions.