We previously posted that Alastair Mactaggart, one of the co-authors of the California Consumer Privacy Act (CCPA), intended to submit a new ballot initiative to strengthen the privacy rights that already exist in the CCPA. The full text of the ballot measure – which is entitled the California Consumer Privacy Rights and Enforcement Act of 2020 – is now available on the California Attorney General’s website. There also is an annotated version of the initiative available here.
While Mactaggart’s press release identified a few of the proposed changes, our initial review of the initiative is that it would bring about a substantial rewrite of the CCPA. While there is a lot to unpack in this initiative, here are our initial highlights:
- The initiative creates a new category of “sensitive personal information” and attaches additional privacy rights to that category. It defines sensitive personal information to include a consumer’s social security, driver’s license, state identification card, or passport number; a consumer’s account log‐in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; a consumer’ precise geolocation; personal information revealing a consumer’ racial or ethnic origin, religion, or union membership; the contents of a consumer’ private communications, unless the business is the intended recipient of the communication; a consumer’ biometric information; data concerning a consumer’ health; data concerning a consumer’s sexual orientation; or other data collected and analyzed for the purpose of identifying such information.
- It adds “purpose limitation”, “storage limitation”, and data minimization language to section 1798.100(a)(1);
- It creates a new category of party entitled “contractor” which functions similar to a service provider except that a service provider processes personal information on behalf of a business whereas a contractor uses personal information disclosed by a business;
- It modifies the requirements application to the collection and use of children’s information;
- It creates a new “Right to Correct Inaccurate Personal Information”
- It creates a new right to know if a business has used information collected about a consumer for political purposes;
- It creates a newly defined term “profiling” and creates certain rights regarding that activity;
- It creates a new right to opt-in prior to the sale of a consumer’s sensitive personal information;
- It adds new definitions (and requirements) for “advertising and marketing”, “cross-context behavioral advertising,” “intentionally interacts”, “large data processor”, “non-personalized advertising”, and “precise geolocation.”
- It finally defines “household.”
- It modifies the definition of business, including creating a new category for joint ventures or partnerships composed of businesses;
- It changes the definition of “deidentified” to link it to the FTC’s guidance (note that a bill that sought this change failed to pass this recent legislative session);
- It modifies the definition of “sale” to include a disclosure of a consumer’s personal information for any commercial purpose, including cross-context behavioral advertising;
- It substantially re-writes the definitions of “service provider” and “third party”;
- It creates a new entity called the California Privacy Protection Agency (the name of which is self-explanatory as to its purpose)
This new measure is intended by Mactaggart to become operative on January 1, 2021, but only apply to personal information collection by a business on or after January 1, 2020. Notably, this measure has no impact on the existing January 1, 2020, CCPA effective date.
Clearly, we are a long way from the finish line on this initiative; however, Mactaggart indicated in a speech at the IAPP’s PSR conference on Wednesday that he thought there was a very strong chance it passes based on early polling. According to Angelique Carson’s great recap Mactaggart said: “We’ve been out there doing focus groups,” “We’re polling in the 90s. My pollster said the last time she saw numbers like this was the time there was something on the ballot on human trafficking.”