New California data-privacy-rights initiative seeks to strengthen data protections beyond the CCPA of 2018

[Delicieuxz]

The group called Californians for Consumer Privacy have submitted a new California Consumer Privacy Act to be put to a statewide referendum in 2020.

 

You might recall that in 2018 California passed a California Consumer Privacy Act that gives Californians some pretty solid data protection rights, ones which I think are stronger than the ones granted by the EU's GDPR:

 

 

California's 2018 Consumer Privacy Act (CCPA) rules come into force July 1st, 2020. And because California has, by far, the United States' largest economy, is where many of the US' biggest tech companies are headquartered, and is home to around 12% of the US' population, I think that data privacy rules in California are likely to impact how big tech companies conduct themselves not just in California, but elsewhere, too.

 

 

Well, there is now a California Consumer Privacy Act of 2020, which seeks to strengthen data privacy rights even further and take into account newer developments in data-harvesting and exploitation methods. To understand why and how this is being done, some backstory is needed about the CCPA of 2018 and certain California law, and things that have happened since the CCPA of 2018 passed.

 

Now, it's uncertain whether the Californian legislative assembly passed those rules out of agreement with them or if they passed them to avoid having the matter go to a statewide referendum, the result of which would have been even stronger rules protecting Californians against data-pilferers and dealers. See, California has a process, called Ballot Initiatives, that allows citizens to craft proposed legislation and then conduct a public petition to try to get a certain amount of signatures in support of the proposed legislation. And if enough signatures are gathered before a deadline, then the proposed legislation will be put to a statewide referendum. And if the referendum turns out in favour of the proposed legislation, then the proposed legislation is made into law - from what I understand, even if it's something California's legislature and government are not in favour of.

 

The California Consumer Privacy Act was started by the group Californians for Consumer Privacy, which had originally intended the matter to be a Ballot Initiative that all California would vote on. They had more than enough support and it was a sure thing to pass and be made into law. For whatever reason, though possibly due to tech industry concerns, Californians for Consumer Privacy decided to let it be passed by California's legislature instead, and in the process some of the initiative's wording and regulation was toned down - not too much, but a bit. By passing the proposed legislation through the legislature rather than have it be voted on in a referendum, a slightly more big tech company-friendly version of the proposed legislation became the law.

 

So, because of that 'if not passed in the legislature a stricter version is guaranteed to pass by referendum' situation, it's difficult to say whether California's governor and legislature genuinely liked and agreed with the CCPA rules, or if they passed it just to avoid a more big tech company-unfriendly version from becoming law by referendum. I would like to think that they do agree with the CCPA rules.

 

So, the proposed legislation became law, to come into force July 1st, 2020. And big tech companies weren't happy about it. They have tried in different methods to stop its regulation of data-harvesting by trying to get in front of the situation and have rules crafted by themselves to be favourable to themselves passed at the federal level, which they hope would override California's state laws:

 

 

They also tried to curtail some of the CCPA's rules by submitting bills to the California State Assembly’s Privacy and Consumer Protection Committee. Unfortunately, the PCPC capitulated to the big tech companies and advanced those bills. And at the same time while the PCPC advanced the big tech company bills to soften the incoming CCPA rules, they declined to advance additional bills submitted by Californians for Consumer Privacy that would strengthen the already-passed CCPA rules.

 

Well, Californians for Consumer Privacy are having none of it, and they are back to their original plan of having full-strength data privacy rights voted on in a statewide referendum. And they aren't doing that simply because of threats to the existing and passed CCPA rules, but also because since the CCPA passed there have developed new ways that tech companies are violating people's privacy and exploiting them for their data, and the CCPA in its current form might not cover all those situations.

 

This is the information about their new ballot initiative that I received in an email from their newsletter:

Quote

On September 25, I filed an initiative to appear on the November 2020 ballot, the California Privacy Rights and Enforcement Act. ‍

 

Read the full initiative (with annotation) here:  https://www.caprivacy.org/CPREA2020.

Or the version as submitted to the California Attorney General's website: here

 

‍In the two years since introducing the legislation that passed as the California Consumer Privacy Act (CCPA), which gives nearly 40 million people in this state the strongest data privacy rights in the country, I’ve realized the immense power consumers are up against when it comes to having true control over their own data. 

During this time, two things have happened: First, some of the world’s largest companies have actively and explicitly prioritized weakening the CCPA. Second, technological tools have evolved in ways that exploit a consumer’s data with potentially dangerous consequences. I believe using a consumer’s data in these ways is not only immoral, but it also threatens our democracy.

‍It is for these reasons that I’m proposing a new law that would:  

• Create new rights around the use and sale of sensitive personal information, such as health and financial information, racial or ethnic origin, and precise geolocation.  
• Provide enhanced protection for violations of children’s privacy by tripling CCPA’s fines for breaking the law governing collection and sale of children’s private information and would require opt-in consent to collect data from consumers under the age of 16.
• Require much-needed transparency around automated decision-making and profiling, so consumers can know when their information is used to make adverse decisions that impact lives in critical ways, including employment, housing, credit, and even politics.  
• Establish a new authority to protect these rights, the California Privacy Protection Agency, which will simultaneously enforce the law and provide necessary guidance to industry and consumers, many of whom are struggling to protect themselves in an increasingly complex digital ecosystem, where hacking and identity theft remain a terrible problem.
• Protect our democratic processes by fixing election disclosure laws and requiring corporations to disclose whether, and how, they use personal information to influence elections.
• Most importantly, it would enshrine these rights by requiring that future amendments be in furtherance of the law, even though I am only setting the threshold to amend at a simple majority in the legislature.  While amendments will be necessary given how technically complex and fast-moving this area is, this approach respects the role of the legislature while still providing substantial protections for Californians from attempts to weaken the law and their new human rights. 

What this new law comes down to is giving consumers the right to take back control over their information from thousands of giant corporations.  This is about power: the more a company knows about you, the more power it has to shape your daily life. That power is exercised on the spectrum ranging from the benign, such as showing you a shoe ad, to the consequential, like selecting your job, your housing, or helping to shape what candidate you support in an election.

Much of the technological revolution is wonderful, and I continue to be amazed that I have the entire contents of all the libraries of the world, all that is best about humanity and innovation, sitting in my pocket, available to inform and educate me.  But equally, we need limits so that people have some measure of equality in the face of this new technology.  Much as in my youth, when there were two societies separated by an iron curtain, and I am convinced that going forward, there will be a data curtain of sorts, separating countries where citizens have rights to stop the constant commercial surveillance that is underway today, and countries where everyone is watched, all the time, for various purposes that are out of a person’s control. 

I am convinced that without regulation, this encroachment into people’s lives will distort the balance of power in society.  In a very fundamental way, democracy depends on privacy.  We are engaged in a new experiment now, where a handful of giant corporations know almost everything about us, chronicling everything we’ve searched for, following every one of our digital footprints, and analyzing that to control what we see every day. These are perhaps the most powerful tools for influence in human history…shouldn’t consumers have a choice about how their own data is used? 
‍
I believe that now is the time to move forward and build on the progress we have already made.  Californians are overwhelmingly supportive of being in control of their most sensitive personal information, and they also want control over how their children’s data is used. Having seen the attempts to weaken what I see as a fundamental human right, I believe it is time to both permanently enshrine these rights, and to provide Californians the same level of protections that citizens have in the rest of the world. I look forward to making this case to the people of California, who so often lead the way for our country in breaking new ground.

Onward!

– Alastair Mactaggart, Board Chair and Founder
Californians for Consumer Privacy

 

The two links at the top of that email contain the full text of the proposed new legislation to be voted on by Californians.

 

If you're Californian and want to see greater data security and privacy, then I recommend sharing this information with people you know. And if you aren't Californian but know people who are, maybe share it with them, too.

 

As a general impression, California's Ballot Initiative system seems wonderful to me, an avenue for genuine direct democracy. I don't know if it's something that could be abused easily, but I kind of think it's less likely to produce bad results than keeping the legislation of a state exclusive to a bunch of politicians, many of whom depend on corporate donations to campaign and for positive coverage in order to keep their job. I think every region should have a Ballot Initiative type of thing.

 

[mr moose]

Is there any new tech news in this or is it just a run down of how policies can become laws in California?  I genuinely was lost trying to work out if new laws have been passed or not and I can't find a link to a news article.

[Unixsystem]

As many problems as I have with the way California (and especially certain Californian cities) tend to run things, that direct ballot system seems pretty rad. 

 

In regards to the law itself, it's hard to say for sure how good/ineffective it will be since it's basically just a vague idea at this stage. That said, we are drastically overdue for an overhaul of digital privacy law so I'm definitely curious how this turns out. 

[Delicieuxz]

6 hours ago, mr moose said:

Is there any new tech news in this or is it just a run down of how policies can become laws in California?  I genuinely was lost trying to work out if new laws have been passed or not and I can't find a link to a news article.

Yeah, this is tech news, and the OP covers all the information. I guess you didn't read far into the OP because a good half of it exclusively details the new initiative.

 

The information about the new initiative was delivered via Californians for Consumer Privacy's email newsletter, and that full email is contained in the OP. It is also available on their website. And the newsletter / website message includes links to the new initiative's proposed legislation.

[mr moose]

2 hours ago, Delicieuxz said:

Yeah, this is tech news, and the OP covers all the information. I guess you didn't read far into the OP because a good half of it exclusively details the new initiative.

 

The information about the new initiative was delivered via Californians for Consumer Privacy's email newsletter, and that full email is contained in the OP. It is also available on their website. And the newsletter / website message includes links to the new initiative's proposed legislation.

but is it new news or not?  Wasn't this all in the previous thread, hasn't the bill basically passed (formality of signing it remaining)? 

 

No offense, but the OP is a 1000 word thesis,  not that you aren't allowed to it all, but for those of us who don't have time to wade through it all and just want a paragraph or two of your opinions and a link to an article it's a bit long.   Maybe  a TL:DR and link at the bottom so we can get the gist.

[FezBoy]

37 minutes ago, mr moose said:

but is it new news or not?  Wasn't this all in the previous thread, hasn't the bill basically passed (formality of signing it remaining)? 

 

No offense, but the OP is a 1000 word thesis,  not that you aren't allowed to it all, but for those of us who don't have time to wade through it all and just want a paragraph or two of your opinions and a link to an article it's a bit long.   Maybe  a TL:DR and link at the bottom so we can get the gist.

Yes it's new.  The CCPA of 2018 is going into action Jan. 1 2020, the CCPA of 2020 will be on the ballot.  The 2020 essentially adds to the previous based on more recent events in the consumer privacy space.

[mr moose]

2 minutes ago, FezBoy said:

Yes it's new.  The CCPA of 2018 is going into action Jan. 1 2020, the CCPA of 2020 will be on the ballot.  The 2020 essentially adds to the previeous based on more recent events in the consumer privacy space.

Thank you.

 

 

[Delicieuxz]

On 10/3/2019 at 10:21 PM, mr moose said:

but is it new news or not?  Wasn't this all in the previous thread, hasn't the bill basically passed (formality of signing it remaining)? 

 

No offense, but the OP is a 1000 word thesis,  not that you aren't allowed to it all, but for those of us who don't have time to wade through it all and just want a paragraph or two of your opinions and a link to an article it's a bit long.   Maybe  a TL:DR and link at the bottom so we can get the gist.

This OP is a new initiative by the same group that started the previous one which already passed in California's legislature. Due to new developments in data-harvesting and also due to tech companies proposing new bills in California to undercut the California Consumer Privacy Act (CCPA) of 2018, Californians for Consumer Privacy (CCP) have made new proposed legislation (CCPA of 2020) to cover those challenges and increase consumer rights over their data compared to the CCPA of 2018.

 

The OP gives all the backstory behind the new proposed legislation and explains that this time it's going to be put to a California-wide referendum instead of going through the California legislature. The CCPA of 2018 was originally also intended for a referendum, but the legislature was willing to pass a slightly watered-down version, and so that was done instead. This time, the CCP is not letting it be watered-down by the legislature.

 

Without explaining the background in the OP, I think people would not know how the new CCPA is different then the already-passed CCPA, why another CCPA is being done at all, and how it's able to be done apart from support of California's government and legislature.

 

 

I've edited the OP to be a bit more clear in its introduction.

[Delicieuxz]

25 minutes ago, FezBoy said:

Yes it's new.  The CCPA of 2018 is going into action Jan. 1 2020, the CCPA of 2020 will be on the ballot.  The 2020 essentially adds to the previous based on more recent events in the consumer privacy space.

It looks like CCPA of 2018 rules come into effect July 1st, 2020, and that I had it wrong when I wrote January 1st 2020 in the OP. I've corrected it now.

[mr moose]

11 minutes ago, Delicieuxz said:

This OP is a new initiative by the same group that started the previous one which already passed in California's legislature. Due to new developments in data-harvesting and also due to tech companies proposing new bills in California to undercut the California Consumer Privacy Act (CCPA) of 2018, Californians for Consumer Privacy (CPA) have made new proposed legislation (CCPA of 2020) to cover those challenges and increase consumer rights over their data compared to the CCPA of 2018.

 

The OP gives all the backstory behind the new proposed legislation and explains that this time it's going to be put to a California-wide referendum instead of going through the California legislature. The CCPA of 2018 was originally also intended for a referendum, but the legislature was willing to pass a slightly watered-down version and that was done instead. This time, the CPA is not letting it be watered-down by the legislature.

 

Without explaining the background in the OP, I think people would not know how the new CCPA is different then the already-passed CCPA, why another CCPA is being done at all, and how it's able to be done apart from support of California's government and legislature.

 

 

I've edited the OP to be a bit more clear in its introduction.

Thank you.