Legislative Amendments to the California Consumer Privacy Act of 2018 — The Good, the Bad, and the Ugly

The deadline for introducing new legislation in the California Legislature for the 2019 Legislative session was February 22, 2019. While new amendments to the California Consumer Privacy Act of 2018 (the “CCPA”) could still be introduced via the “gut and amend” maneuver (which is how the CCPA itself was introduced in June 2018), we now have a general idea of the proposed amendments to the CCPA that will be considered by the Legislature this year.  This Post provides a brief overview of those pending amendments.

The Good – AB 846, AB 981, AB 1146, AB 1355, AB 1416. Some proposed amendments attempt to clarify the CCPA and limit its application in areas that previously were ambiguous.  For example, Assembly Bill 846, introduced by Assemblymembers Autumn Burke (D – Los Angeles), Evan Low (D – Silicon Valley) and Kevin Mullin (D – San Mateo), would amend the CCPA to clarify that the statute “does not prohibit a consumer from choosing to participate in a customer loyalty program that offers incentives such as rewards, gift cards or certificates, discounts or other benefits”.

Assembly Bill 981, introduced by Assemblyman Tom Daly (D – Santa Ana), would amend Section 791.01 of the California Insurance Code to clarify that insurance institutions, insurance agents, insurance support organizations and insurance transactions are exempted from the application of the CCPA.

Assembly Bill 1146, introduced by Assemblyman Marc Berman (D – Palo Alto), would amend the CCPA to add a new subsection to the exceptions to the application of the CCPA listed in California Civil Code Section 1798.145, clarifying that the CCPA does not apply to “vehicle information . . . shared between a new motor vehicle dealer . . . and the vehicle’s manufacturer, manufacturer branch, distributor, distributor branch, or affiliate, if the vehicle information is shared [sic] pursuant to, or in anticipation of, a vehicle repair relating to warranty work or a recall”.

Assembly Bill 1355, introduced by Assemblyman Ed Chau (D – Monterey Park), would correct a number of typographical errors in the CCPA. Further, the bill would exempt deidentified or aggregate consumer information from the definition of “personal information” under the CCPA.  This appears to have been the intent of the Legislature in enacting the CCPA, but the statute, as enacted, failed to do so.  AB 1355 would correct that error.

Finally, Assembly Bill 1415, introduced by Assemblyman Ken Cooley (D – Rancho Cordova), would add provisions to California Civil Code Section 1798.145, clarifying that the CCPA does not restrict a business from collecting, using, selling or disclosing nonpublic personal information in order to (1) exercise, defend or protect against legal claims; (2) protect against or prevent fraud or unauthorized transactions; (3) protect against or prevent security incidents or other malicious, deceptive or illegal activity; or (4) investigate, report or prosecute those responsible for fraud, unauthorized transactions, security incidents or other malicious, deceptive or illegal activity. The amendments would also clarify that the CCPA does not restrict a business from helping another person or governmental entity in engaging in the actions listed above.

The Bad – AB 1281.  Other proposed amendments would add further restrictions to the CCPA, broadening its application.  For example, Assembly Bill 1281, introduced by Assemblyman Chau, would add a new Section 1798.300 to the CCPA, which would require a “clear and conspicuous” disclosure by way of a “physical sign at the entrance of every location that uses facial recognition technology”.  The amendment would provide that a violation of that part of the CCPA constitutes unfair competition under California Business and Professions Code Section 17200, et seq., which would permit any consumer to bring a lawsuit for a violation of that requirement.

The Ugly – SB 561. The most significant development this Legislative session is Senate Bill 561, introduced on February 20, 2019, by Senator Hannah-Beth Jackson (D – Santa Barbara).  SB 561, which is backed by the California Attorney General, would amend the CCPA to permit consumers to bring a lawsuit against a business for any violation of the CCPA (currently, the CCPA contains only a very limited private right of action if a consumer’s personal information is exposed or acquired by an unauthorized third party in a data breach).  This bill would also eliminate the 30-day right of a business to cure a CCPA violation before a lawsuit can be filed, and would eliminate the right of businesses to seek the opinion of the Attorney General regarding compliance with the CCPA.  For more details on SB 561, see our web blog post dated February 24, 2019.  Since then, SB 561 has been assigned to the Senate Judiciary Committee, the first step in passing the bill through the Senate.

The Benign – AB 25, AB A73, AB 874, AB 1564, AB 1758, AB 1760, SB 752, SB 753.  Finally, a number of pending bills are either blank (intended to be amended to add substance later), as in the case of Assembly Bill 25, introduced by Assemblyman Chau and Assembly Bill 873 and Assembly Bill 874, both introduced by Assemblywoman Jacqui Irwin (D – Thousand Oaks), or would make purely stylistic and typographical edits to the language used in the CCPA, as in the case of Assembly Bill 1760, introduced by Assemblywoman Buffy Wicks (D – Oakland), Assembly Bill 1758, introduced by Assemblyman Chau, and Senate Bill 752 and Senate Bill 753, introduced by Senator Henry Stern (D – Canoga Park).

Similarly, Assembly Bill 1564, introduced by Assemblyman Berman, would amend the CCPA to require a business to make available a toll-free telephone number or an email address to consumers for submitting verifiable consumer requests under the CCPA (previously, the CCPA required only a toll-free telephone number). If the business maintains an internet website, the bill would also require the business to make the internet website available to the consumer to submit verifiable consumer requests under the CCPA.

Conclusion. With no fewer than 16 bills pending that would amend the CCPA (plus the possibility of additional amendments being introduced through the “gut and amend” procedure), it is impossible to predict how the CCPA will ultimately be amended before its January 1, 2020, effective date. Senate Bill 561, which would add a full private right of action to the CCPA, is an early frontrunner, however, having been backed by the California Attorney General.  However, we are still early in the 2019 Legislative cycle, and if the past is any indication, it would be best to “expect the unexpected.”