Ballot Pressure Leads to New Californian Privacy Law

Irving Hamilton
July 6, 2018

The law will compel companies to tell customers upon request what personal data they've collected, why it was collected and what categories of third parties have received it.

Between 16 and 13 must opt in: The CCPA prohibits a business from selling the personal information of a consumer under 16 years of age, unless affirmatively authorized, as specified, to be referred to as the right to opt in.

AB375 goes into effect starting January 1, 2020, giving companies adequate time for planning and making necessary changes, while the legislature could possibly make some alterations as well. A bill passed by the legislature is easier to amend than a ballot initiative. For others, like those defined as covered entities under HIPAA, the law does not apply to protected health information regulated by HIPAA's privacy, security and breach notification rules. The initiative, which had qualified for the November 2018 ballot, would have put in place an even stricter privacy law that was widely opposed by the technology community. This ballot initiative received 625,000 signatures, which is nearly twice the number required for an initiative to be included on the California ballot. The provisions of the California Consumer Privacy Act become operative only if the Ballot Initiative is withdrawn from the ballot.

The potentially broad reach of the CCPA is underscored by its definition of personal information, which expands far beyond traditional identifiers such as name, address, and social security number.

The CCPA will apply to a wide variety of consumers' "personal information" including all information that "relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household".

The consumer rights embedded in the CCPA will look familiar to those who have been dealing with the GDPR. Given the amount of consumer information that is collected by many businesses today, it is thus likely that the CCPA will have broad reach.

Consumers will also be able to ask companies to delete their information and refrain from selling it.

ON HEALTH: Lyme disease | Community
For several years British doctors could not pinpoint what was ailing her. "[The] tick problem here will stay with us". That means they are carriers of the agents that cause Lyme disease in people.

Businesses subject to these requirements must begin to map out all personal information collected and shared from Californians.

Businesses will now be required to implement various new policies and procedures ensuring the protection of personal information, including updates to privacy policies, "reasonable" security protections, and facilitation of consumer rights.

Enforcement of the CCPA by the Attorney General or, under certain circumstances, by consumers, with potential statutory damages per violation or record.

Damages: Limited to not less than $100, and not more than $750.

Additionally, there are further limits imposed on the right of action.

Prior to initiating action, consumer must provide the business 30 days' written notice specifying which portions of the title that the business is alleged to have violated. Instead, civil penalties for violations of the statute would be exclusively assessed and recovered in civil actions brought by the California Attorney General.

"We believe the resulting 18-month period before implementation will allow for more debate that will eventually end in a law that has little effect on the digital advertising industry", Andy Hargreaves, an analyst at KeyBanc Capital Markets said in a note to clients this week.

Other reports by

Discuss This Article