CCPA 2.0? A New California Ballot Initiative is Introduced

Introduction

On September 13, 2019, the California State Legislature passed the final CCPA amendments of 2019. Governor Newsom is expected to sign the recently passed CCPA amendments into law in advance of his October 13, 2019 deadline. Yesterday, proponents of the original CCPA ballot initiative released the text of a new initiative (The California Privacy Rights and Enforcement Act of 2020) that will be voted on in the 2020 election; if passed, the initiative would substantially expand CCPA’s protections for consumers and obligations on businesses. While the new proposal preserves key aspects of the current CCPA statute, there are some notable additions and amendments.

Notable Provisions 

The California Privacy Rights and Enforcement Act of 2020 ballot initiative would:

• Create the “California Privacy Protection Agency,” an independent executive agency tasked with protecting consumer privacy, ensuring that consumers are well-informed about their obligations and rights, promulgating regulations, and enforcing the law against businesses that violate of consumer privacy rights. The initiative provides for a hand-off process from the California Attorney General to this new agency; the AG’s office is currently responsible for CCPA education, rulemaking, and enforcement activities.
• Add a new category of personal information to the CCPA called: “sensitive information,” which includes: precise geolocation information, social security number, passport number, customer’s account log in, financial account, personal information revealing a consumer’s racial or ethcinic origin, religion, union membership, or sexual orientation, among other categories.
  • Consumers are granted new rights over “sensitive information” such as the right to opt-out, at any time, from a business disclosing or using sensitive personal information for advertising and marketing or disclosing this information to a service provider or contractor for these purposes. 
  • Businesses shall provide a separate link for users to exercise this opt-out right.
  • Businesses must obtain opt-in consent prior to the sale of a consumer’s sensitive personal information. A consumer who opted-in to the sale of sensitive personal information can revoke this authorization at any time.
• Create a new right to correct inaccurate personal information.
• Require opt-in consent for the collection of personal information from children under 16, and increase penalties for children’s privacy violations.
• Provide that a consumer may request that a business disclose personal information collected beyond the currently-required 12-month period, and the business must provide such information unless doing so would be unduly burdensome or involve a disproportionate amount of information.
• Require that a business must notify the consumer and state, when using a consumer’s personal information to advance the business’s political interests on their own behalf, or influence the outcome of an election.
• Enact additional notice requirements for businesses, including but not limited to, specific requirements for “third parties.”
• Amend the definition of a “business” as having 100,000 or more consumers or households, rather than the CCPA’s 50,000 or more consumers, households, or devices.
• Amend the definition of “business purpose” to include new elements such as: “non-personalized advertising” (not based on a profile or predictions derived from a consumer’s past behavior) provided the information is not disclosed to a third party, used to build a profile of the consumer, or alter the consumer’s experience with the business.
• Amend the definition of  “deidentified” to: “information that cannot reasonably be used to infer information about, or otherwise be linked to, an identifiable consumer,” if the business meets certain requirements. The Attorney General will provide additional regulations related to the definition of “deidentified.” 
• Define “household” as “a group, however identified, of consumers who cohabitate with one another at the same residential address and share access to common device(s) or service(s) provided by a business.”
• Provide that the provisions of the ballot initiative may be amended after it is approved by voters by a statute that was passed by a majority of members of the California State Legislature, and signed by the governor if the amendments are “consistent with and further the purpose and intent” of the Act.

Next Steps

According to the California Elections Code (ELECT CA ELEC § 9002), the California Attorney General will hold a 30-day review process and public comment period, followed by five additional days for proponents of the initiative to amend the proposal, prior to the initiative appearing on the ballot.

As stated above, this proposal provides an idiosyncratic approach to the legislative process for laws passed via a ballot initiative by allowing for amendments after it is signed by the governor if the amendments are “consistent  with and further the purpose and intent” of the Act. This approach suggests a willingness to pass new amendments to help the law keep pace with emerging technology. The standard process for amending ballot initiatives requires a supermajority vote of the legislature.