As federal lawmakers debate the possibility of a national privacy law, California legislators are considering a new bill that would amend the state’s Consumer Privacy Act (CCPA) with a broader private right of action and remove the right to cure deficiencies.
For years, privacy bills have been introduced and debated, and then languished, in Congress. Federal lawmakers are at it again, however, recently holding hearings before the Senate Commerce, Science and Transportation Committee, as well as a subpanel of the House Energy and Commerce Committee, to discuss the issue.
Thanks in part to data breach scandals and a recommendation from the Government Accountability Office, legislators generally agree that a national law would benefit consumers. However, the specifics of a possible law are proving divisive, particularly the issue of existing state laws.
Several federal bills have been introduced, some expressly preempting state laws and others providing a federal floor of privacy rights that leaves room on which the states can build. At the hearings, the discussion centered around the impact of existing state laws, notably the CCPA.
“Without a consistent federal privacy standard, a patchwork of state privacy laws will create consumer confusion, present substantial challenges for businesses trying to comply with these laws, and fail to meet consumer expectations about their digital privacy,” Dave Grimaldi, executive vice president of public policy at the Interactive Advertising Bureau, told lawmakers.
Denise Zheng, the vice president for technology and innovation at Business Roundtable, advocated for a similar position. The goal of federal legislation should be “a comprehensive national law that ensures consistent privacy protections and avoids a state-by-state approach that leads to consumer confusion and makes compliance nationwide very challenging,” she testified.
Providing a counterpoint, the president of the Center for Democracy and Technology, Nuala O’Connor, urged lawmakers to provide states with enforcement rights or risk overburdening the Federal Trade Commission. “There will simply be no way for a single agency like the FTC to absorb this magnitude of new responsibilities,” she said. “Additionally, each state has a unique combination of demographics, prevailing industries, and even privacy values, and many privacy or security failures will not affect them equally.”
As the debate continues at the federal level, California State Sen. Hannah-Beth Jackson (D-Santa Barbara) proposed amendments to the CCPA that would increase the statute’s consumer protections.
Senate Bill 561 would add a private right of action to the statute so consumers could file suits on an alleged violation of any section of the law. Currently, the CCPA permits a consumer to file suit only when his or her unencrypted or nonredacted personal information is breached “as a result of a violation of the duty to implement and maintain reasonable security procedures and practices,” and imposes a recovery limit of $750 in statutory damages per incident.
In addition, SB 561 would remove the existing “right to cure,” under which the attorney general is required to give businesses notice and 30 days to cure alleged violations of the CCPA before taking legal action.
California Attorney General Xavier Becerra backed the proposed bill, calling it “a critical measure to strengthen and clarify” the statute.
To read SB 561, click here.
Why it matters: The proposed changes to the CCPA would greatly expand potential liability for businesses under the statute, from private rights of action based on any alleged violations to the loss of the cure period. With the enforcement deadline for the CCPA set for 2020, ad industry groups are now fighting on multiple fronts, expressing concerns about the CCPA as currently drafted, while continuing their push for federal legislation that would preempt the California law.