In the latest developments surrounding state-level privacy laws, legislators advanced amendments that could ease the burden of the California Consumer Privacy Act (CCPA), while the Washington Privacy Act (WPA) appears dead in the water—for now.
The California Assembly’s Privacy and Consumer Protection Committee voted in favor of multiple proposals to amend the country’s most stringent privacy law, set to take effect January 1, 2020.
Committee members unanimously approved AB 25, an attempt to clarify that employees are not “consumers” for purposes of the CCPA, as long as the personal data is collected and used solely within the context of the employer/employee relationship (or if a written contract is in place for contractors).
AB 873 also made it past the committee, providing a qualification that personal information does not encompass all “information that is … capable of being associated” with a particular individual or household, but is instead limited to information that is “reasonably capable” of being so associated.
Lawmakers on the committee also signed off on AB 846, a measure that would exempt voluntary participation in loyalty programs from the CCPA’s nondiscrimination restrictions; AB 1564, which would create alternatives to the CCPA’s mandate that businesses establish a toll-free number to receive requests under the statute; and AB 874, a proposal for an exemption to the definition of “personal information” for public records.
In addition, AB 1146 (permitting the sharing of motor vehicle warranty information between auto dealers and manufacturers), AB 1355 (featuring various technical changes to address drafting errors in the CCPA) and AB 981 (attempting to align the CCPA with the Insurance Code) also passed.
While the amendments moved forward in the House, their ultimate chances of legislative approval remain unclear, particularly with SB 561 still alive. That measure—which has already been approved by both the Senate Judiciary Committee and the Senate Appropriations Committee—would expand the CCPA’s private right of action and remove the existing 30-day “right to cure.”
California is not the only battleground for state privacy laws. Washington appeared poised to be the next state to enact consumer privacy protections when the state Senate passed the WPA in an almost unanimous vote in March.
The bill would provide consumers in the state with the right to learn what data is collected about them and whether the information is sold to outside companies; the opportunity to correct inaccurate data and, in some instances, delete it; and the right to withdraw previous consent for the use of personal data.
However, the legislation stalled in committee and never made it to the House floor for a vote. Fingers were pointed in every direction when it became clear the measure had failed, with privacy advocates arguing that the tech industry had weakened the original bill to the point that it wasn’t worth passing, while the ad industry reiterated its stance that any privacy legislation should be national in scope.
To read AB 25, click here.
To read AB 873, click here.
To read AB 846, click here.
To read AB 1564, click here.
To read AB 874, click here.
To read AB 1146, click here.
To read AB 1355, click here.
To read AB 981, click here.
Why it matters: As the CCPA’s effective date draws closer, many unanswered questions remain about the statute. From the multiple bills seeking to clarify and/or modify the law to the regulations yet to be issued by the California attorney general’s office, it’s tough for companies to prepare. Washington entities appear to have dodged the first attempt at the enactment of a consumer privacy law in the state, although supporters of the WPA are already planning ahead for the next legislative session—sponsor Sen. Reuven Carlyle tweeted that he is “committed to 2020.”