Five new bills threaten California’s privacy act, experts say

Five digital privacy bills are up for consideration in the California Senate’s judiciary committee on Tuesday that would drastically alter the California Consumer Privacy Act. The new legislation could reverse many of the measures improving security of consumers’ personal data under the landmark privacy bill, which is set to go live in 2020.

The bills — AB 1416, AB 25, AB 873, AB 846 and AB 1564 — are intended to repeal and amend much of the CCPA, which set a new standard for consumer data protection after being signed into law last June. When it goes live, the law will enable consumers to know which companies are collecting and sharing their digital data and to opt out of such data collection. Companies that do not comply can be fined by the state’s attorney general.

The new bills, however, could weaken key parts of the legislation before it goes into effect. AB 1416, identified by privacy advocates as the most pernicious of the five bills up for consideration, would allow any business to sell personal information even after a consumer opts out, if the sale is conducted for the purposes of detecting fraud or other illegal activity. Privacy advocates say this exception is far too broad, however, and would allow companies a loophole to continue selling data.

“These new carve-outs run contrary to the purpose of the CCPA,” the American Civil Liberties Union said in a written statement. “Due to the increasing use of machine learning and other data-driven algorithms, companies could sell vast amounts of data, purportedly for anti-fraud purposes.”

AB 873 would narrow the CCPA’s scope, eliminating data such as IP addresses from being included in its definition of “personal information,” so long as they weren’t attached to any name or Social Security number. ACLU lawyer Jake Snow described AB 873 as a “Trojan Horse” bill. If passed, he said, companies wouldn’t be penalized for tracking and selling consumers’ online habits.

AB 825 would exempt employers from CCPA protections, allowing them to collect data on their current and former employees. AB 846 would grant businesses the right to force consumers to pay to ensure their data is not collected or stored, while AB 1564 would eliminate the requirement for businesses to provide a phone number for consumers to call with data-related questions.

Ariel Fox Johnson, senior counsel for policy and privacy at Common Sense Media, a nonprofit that advocates for technology that is safe for children, said these bills are backed by the big technology firms that lobbied for a weaker version of the CCPA, such as Comcast, Facebook, Google, Verizon and AT&T.

“Basically everyone wants an exception for anything they’re doing,” Johnson said. “Either they want an exception for their industry, like tech providers or commercial credit reporters or insurance companies, or folks want an exception related to specific practices, like ad targeting, so they all basically just want to be carved out of the law.”

The new legislation could have implications that alter privacy rules outside California. Earlier this year, Vermont Attorney General T.J. Donovan said that California’s policy could directly influence the behavior of other state privacy officials.

“As California goes, so goes the nation,” Donovan told a Washington D.C. conference in January. “Watching how the rules in California are going to be developed is going to be critical.”

If the bills pass committee on Tuesday, they’ll move onto a floor vote in the state Senate.