In two weeks, Californians might reform the data-harvesting and data-privacy landscape - Updated Nov 4th

[Delicieuxz]

November 4th update:

Just now, Delicieuxz said:

Given privacy advocates' concerns about issues with the CPRA, I was kind-of hoping it wouldn't pass and that a new attempt that fixes its issues would be made. But it seems that it's on-track to be approved.

 

Election impact: Why the passing of California's Prop 24 matters for marketers and what to expect in 2021

 

Quoted from the article:

 

CPRA would:

• Create a broad category of "sensitive" personal data—a designation that includes such things as a person's racial or ethnic origin, their genetic data, their sexual orientation, and information about their health, among other information—which consumers can limit to approved uses.
• Give consumers the right to correct information businesses have on them.
• Strengthen opt-in requirements for data on children, with stronger penalties for forbidden use or sharing.
• Provide an opt-out for "cross-context behavioral advertising," defined in CPRA as targeted advertising based on users' personal information that was collected across a variety of digital touchpoints, such as websites, apps, and services.  

Why this matters for marketers:

• California is by far the largest state economy in the US, and the law would de facto become a national legal standard for most large advertisers.
• Laws to protect privacy will limit marketers' ability to personalize digital advertising. These laws also make data security more important, meaning that companies that use data will need to have more emphasis on data protection, introducing a new need for data protection officers, for example.
• A June 2019 Pew Research Center privacy survey found that 85% of US internet users had some concerns about how much information advertisers had about them, and nearly half of those (39%) had "a lot" of concern. A "yes" vote on Proposition 24 would set a standard for Congress and other state legislatures facing similar popular calls for privacy regulations.

What we can expect in 2021:

• If Prop 24 passes, as seems likely, it will create an unofficial deadline for a federal data privacy law. "I think that CPRA's most impactful provision is when it takes effect: January 2023," said Caitlin Fennessy, research director at the International Association of Privacy Professionals (IAPP). "If adopted, CPRA would create the impetus and provide the timeframe for adoption of federal privacy legislation. And I think that was intentional on the part of the ballot initiatives' proponents."

 

 

Original post:

 

This is the latest development on a topic that's been reported about multiple times since 2018.

 

California (and many other US sates) has a fantastic democratic legal mechanism called Ballot Initiatives, which allows private citizens to propose and potentially implement new laws without needing to go through or have the approval of California's legislature and politicians. All a California citizen has to do is get enough public support in the form of signatures to support a proposition, and then that proposition will go to a state-wide referendum. And if the vote passes, the proposal becomes the law in California.

 

A group called Californians for Consumer Privacy sought to implement strict data-harvesting and data-sharing regulations back in 2018 with a ballot initiative called the CCPA, and they had overwhelming support from the people of California for their proposed legislation. But the legislature of California wanted to avoid the matter becoming a ballot initiative, and so they agreed to pass the proposed legislation themselves with just a slight bit of watering-down on its wording. CPA agreed to that, and that version of the legislation passed in late June, 2018, and the new data-rights rules came into force on January 2020 and some tech giants have voluntarily applied those rules everywhere and not just in California (which it's expected they did in order to avoid federal legislation forcing even stricter regulations on them).

 

But CPA were left unsatisfied with both the watered-down version of their legislation proposal, and also with how tech companies were finding ways to side-step and undermine the rules. So, in October 2019, they announced they would seek a new ballot initiative that would supersede the 2018-passed rules, strengthen them all-around while encompassing a broader scope, and protect them from being undermined by tech companies.

 

CPA were able to get the required number of signatures from Californians supports their new initiative. And now their new initiative, Proposition 24, will be voted-on by Californians in two weeks, on November 3. And, as with the 2018 CCPA, whatever the outcome of the vote is likely to affect data-harvesting and data-privacy across the US and even beyond its borders.

 

 

But not everyone is on-board with Proposition 24, with some rights groups and critics calling it a mixed bag of changes, with too many loopholes for big tech companies and hurdles for people to enact their right to control their data.

 

Why EFF Doesn’t Support California Proposition 24 - "EFF does not support it; nor does EFF oppose it."

 

Yes, Privacy Is Important, But California's New Privacy Bill Is An Unmitigated Disaster In The Making

 

ACLU Proposition Endorsements For 2020 Election - "NO on Prop 24 that is a fake privacy law. Instead of increasing protections, it requires people to jump through more hoops and adds anti-privacy loopholes for big business."

 

 

 

https://www.caprivacy.org/

Quote

Proposition 24 will give Californians the strongest privacy rights in the country. With just two weeks left until Election Day, it’s critical that we not lose momentum. While 77% of likely voters planning to vote YES on Prop 24, EVERY vote matters! 

Prop 24 would: 

1. Protect your most personal information, by allowing you to prevent businesses from using or sharing sensitive information about your health, finances, race, ethnicity, and precise location;
2. Safeguard young people, TRIPLING FINES for violations involving children's information;
3. Put new limits on companies' collection and use of our personal information;
4. Establish an enforcement arm—the California Privacy Protection Agency—to defend these rights and hold companies accountable, and extend enforcement including IMPOSING PENALTIES FOR NEGLIGENCE resulting in theft of consumers’ emails and passwords;
5. MAKE IT MUCH HARDER TO WEAKEN PRIVACY in California in the future, by preventing special interests and politicians from undermining Californians’ privacy rights, while allowing the Legislature to amend the law to further the primary goal of strengthening consumer privacy to better protect you and your children, such as opt-in for use of data, further protections for uniquely vulnerable minors, and greater power for individuals to hold violators accountable.

Join us in our fight for our privacy! 

 

 

Here's the detailed history of this ballot initiative, ordered from the most recent development to the oldest:

 

 

 

 

 

 

[Delicieuxz]

The Electronic Frontier Foundation's reservations against Proposition 24, which they explain each of in their article, are categorized as:

 

- More compulsion to pay for our privacy

- A missed opportunity on privacy-preserving defaults

- A half-step on data minimization

- Erosion of the right to delete

- Weaker biometric privacy

- More mixing of data

- No enforcement by consumers

 

I am wondering, why doesn't EFF, which is located in San Francisco, California, create their own ballot initiative with the improvements they want to see? And did they offer counsel to CPA as they formed their new ballot initiative?

[DrMacintosh]

The proposition was so clearly explained on the ballot its almost guaranteed to pass:

Quote

A "yes" vote supports this ballot initiative to expand the state’s consumer data privacy laws, including provisions to allow consumers to direct businesses to not share their personal information; remove the time period in which businesses can fix violations before being penalized; and create the Privacy Protection Agency to enforce the state’s consumer data privacy laws.

A "no" vote opposes this ballot initiative to expand the state’s consumer data privacy laws or create the Privacy Protection Agency to enforce the state’s consumer data privacy laws.

 

[Random_Person1234]

Californian here, I didn’t know propositions were not common in other states. This prop. is likely to pass, although my only opposition to it is that I would need to send a form to every tech company telling them not to use my data, which seems like a big hassle for the consumer.

[Delicieuxz]

11 minutes ago, Random_Person1234 said:

Californian here, I didn’t know propositions were not common in other states. This prop. is likely to pass, although my only opposition to it is that I would need to send a form to every tech company telling them not to use my data, which seems like a big hassle for the consumer.

A lot more states have ballot initiatives than I realized.

 

https://en.wikipedia.org/wiki/Initiatives_and_referendums_in_the_United_States

 

This means that states could really take data-harvesting into their hands and put a stop to it across the US, if there was a coordinate effort to do so. States across the US could impose other very beneficial legislation concerning things like software ownership rights with a coordinated efforts.

 

 

The part about Proposition 24 of having to instruct a tech company to not use your data is a major issue with the proposition. I hope that will be fixed with a follow-up measure that ensures tech companies need to be given permission to use data, rather than need to be told to not use it.

[Taf the Ghost]

2 hours ago, Delicieuxz said:

The Electronic Frontier Foundation's reservations against Proposition 24, which they explain each of in their article, are categorized as:

 

- More compulsion to pay for our privacy

- A missed opportunity on privacy-preserving defaults

- A half-step on data minimization

- Erosion of the right to delete

- Weaker biometric privacy

- More mixing of data

- No enforcement by consumers

 

I am wondering, why doesn't EFF, which is located in San Francisco, California, create their own ballot initiative with the improvements they want to see? And did they offer counsel to CPA as they formed their new ballot initiative?

Because that's not the "game" for them. At this point, they exist in that nebulous NGO area that's a useful front for different groups. What started as something useful fell to the siren song of donor support.

[Delicieuxz]

 

 

 

https://www.mercurynews.com/2020/08/15/editorial-prop-24-privacy/

Quote

Instead, voters are being asked to wade through a 52-page ballot measure that has consumer groups with years of privacy expertise divided. The ACLU, the Consumer Federation of California and Media Alliance  oppose Prop. 24. Consumer Watchdog backs it, while Consumer Reports is neutral.

 

One provision of Prop. 24 demonstrates why it doesn’t deserve support.

 

It would allow the Legislature to approve an amendment with a simple majority vote — with this caveat: “The law should be amended, if necessary, to improve its operation, provided that the amendments do not compromise or weaken consumer privacy, while giving attention to the impact on business and innovation.”

 

Wow.

 

How much “attention” needs to be given to the impact on business and innovation? Does it mean that a law strengthening consumer privacy is illegal if it negatively impacts business? To what degree? Bring on the lawyers. California’s courtrooms are crowded enough without the rash of lawsuits this provision would bring.

 

Just as troubling, Prop. 24’s “opt-out” language allows businesses to collect consumers’ data unless users change settings on their devices. It should be just the opposite: Businesses should only collect data on users that “opt-in” by affirmatively granting permission. Yes, writing opt-in language can be constitutionally challenging, but consumer advocates have long held that privacy should be the default approach.

 

Finally, Prop. 24 would allow companies to charge higher prices to consumers who choose to protect their privacy. That’s just wrong on principle. It also places a higher burden on lower-income consumers who do not have the means to pay a premium for a superior product.

 

Voters should reject Prop. 24. Let’s wait and see how effective the state’s new online law works. If it needs change, give the Legislature a chance to fix any flaws before taking another ballot measure to the people.

 

[Delicieuxz]

1 minute ago, Taf the Ghost said:

Because that's not the "game" for them. At this point, they exist in that nebulous NGO area that's a useful front for different groups. What started as something useful fell to the siren song of donor support.

The increase on compulsion to pay for services without data-harvesting doesn't immediately bother me too much. The failure to mandate the default to be opt-in, rather than opt-out, however, is very problematic, to me. And I haven't looked into in what way the right to delete data is weakened by the updated CPA, but it should be that everyone can require their personal data to be deleted per their sole discretion.

[Delicieuxz]

 

https://lwvc.org/vote/elections/ballot-recommendations/prop-24consumer-data-privacy

Quote

Our concerns, flagged by leading consumer and privacy organizations, include the following:

• Pay for Privacy. Prop 24 expands the ability, which already exists in the CCPA, for businesses to provide inferior service for consumers who don’t pay to protect their confidential information, and superior service for Californians who do pay. Under current law a charge is allowed if it’s reasonably related to the value provided to the business by the consumer’s data. Prop 24 expands current law by exempting loyalty clubs and rewards programs from existing limits and allows businesses to withhold discounts unless they can harvest data about shopping habits.
• Opt-out versus opt-In. Prop 24 misses an opportunity to enact a consumer-friendly opt-in system and keeps the burden on consumers to opt-out of the retention and sale of their information.
• Opting out is more difficult. Prop 24 allows businesses to post a Do Not Sell link on their website as an alternative to complying with global opt-out browser or phone settings chosen by the consumer. While global settings may not be available yet, they will be soon. Unfortunately, Prop 24 would throw us back into the world of placing an exhausting burden on consumers to notify every online business, website, and app to preserve their privacy.
• Inequitable. Prop 24 preserves and exacerbates the problem of inequitable access to privacy rights. From its pay for privacy components to a complicated opt-out structure, it places the burden on the average consumer to protect their own privacy. Working people don't have the time to do the paperwork and they can't afford to pay companies to respect their wishes. As a result, Prop 24 will disproportionately harm vulnerable communities, like the poor and elderly.
• Impedes minimization of data collection. Instead of limiting the collection of a consumer’s personal information to what is necessary to provide the service or good a consumer seeks, Prop 24 allows the business to collect consumer information according to the business’ view of what data is needed to accomplish its commercial purposes.
• Weakens biometric data protections. Prop 24 weakens consumer protections for businesses collecting biometric information, such as DNA or faceprints. Current law protects biometric data if it “can be used” to identify a consumer, but Prop 24 protects it only if it “is used or intended to be used” to identify a consumer.
• Exposes social media data to mining. Prop 24 expands the definition of publicly available information to include information collected from social media sources. This opens the door to the sort of problem we saw with Clearview where the company amalgamated images of people, created a facial recognition database, and then sold access to that database to law enforcement, including federal immigration authorities. Nota Bene: Clearview has since announced that they are no longer selling to private companies.
• Makes data deletion more difficult. Prop 24 reduces a business’s duty to send the consumer’s deletion request to downstream entities who also received that consumer’s data from the business. In this way, service providers are more able to combine sets of consumer data collected from different businesses or from consumers.
• Limits privacy rights to California. Under current California law, your privacy follows you wherever you go. Under Prop 24, while a user’s data would be protected within California, any stored data could be collected and used by a business when the user leaves California.

 

[Random_Person1234]

2 hours ago, Delicieuxz said:

A lot more states have ballot initiatives than I realized.

 

https://en.wikipedia.org/wiki/Initiatives_and_referendums_in_the_United_States

 

This means that states could really take data-harvesting into their hands and put a stop to it across the US, if there was a coordinate effort to do so. States across the US could impose other very beneficial legislation concerning things like software ownership rights with a coordinated efforts.

 

 

The part about Proposition 24 of having to instruct a tech company to not use your data is a major issue with the proposition. I hope that will be fixed with a follow-up measure that ensures tech companies need to be given permission to use data, rather than need to be told to not use it.

Propositions are also prevalent on the local level, at least in my county. They're pretty tedious to vote on, it took me 2 hrs. to research and fill in all like 25 of them. 

[Orange1]

3 hours ago, TempestCatto said:

It's not often you see something good come out of California. In fact, I can't remember the last time something did.

When you say out of Cali, yeeeup lots are leaving cali

[DrMacintosh]

42 minutes ago, Delicieuxz said:

Finally, Prop. 24 would allow companies to charge higher prices to consumers who choose to protect their privacy. That’s just wrong on principle. It also places a higher burden on lower-income consumers who do not have the means to pay a premium for a superior product.

I don’t see how that’s bad. I pay a premium for my personal tech devices all the time and I’m ok with that because I know my data is being protected and not sold. 
 

The internet is free because we collectively agreed that selling our data is a fair price. If you don’t believe that, then you have to pay for the cost of the internet somehow. 

[The Sloth]

23 minutes ago, DrMacintosh said:

I know my data is being protected and not sold. 

No one sells data, it's too valuable. Companies like apple and google makes a profile so they can give you ads and give App devs more info on how they can make apps better. 

 

 Unless you use Gappless LineageOS and get your apps from Fdroid, your data is being harvested. 

 

[kpluck]

Quote

Establish an enforcement arm—the California Privacy Protection Agency

 

Hard "no" from me then. California government is awful. A bureaucratic nightmare. We have existing state agencies to handle law enforcement. We don't need another.

 

-kp

[SansVarnic]

12 hours ago, Random_Person1234 said:

Californian here, I didn’t know propositions were not common in other states. This prop. is likely to pass, although my only opposition to it is that I would need to send a form to every tech company telling them not to use my data, which seems like a big hassle for the consumer.

Seems like a "do not share" list needs made similar to the "do not call list" created years ago.

[Trik'Stari]

Worth pointing out that judges in California have taken upon themselves the authority to overturn ballot initiatives and prevent them from appearing on the ballots.

 

This happened a while back after a group got enough signatures to try and break up California into multiple states (which would be a good thing) because they do not get enough representation in the state legislature because of population distribution issues.

 

I do not recall if anyone ever successfully sued to have those judges rulings overturned. I shall look further into this.

 

( https://www.sfchronicle.com/politics/article/Splitting-up-Calif-State-Supreme-Court-takes-13085880.php if anyone is interested.)

[DrMacintosh]

11 hours ago, The Sloth said:

No one sells data, it's too valuable.

Then proceeds to describe how Google sells data*

[DrMacintosh]

1 hour ago, Trik'Stari said:

Worth pointing out that judges in California have taken upon themselves the authority to overturn ballot initiatives and prevent them from appearing on the ballots.

 

This happened a while back after a group got enough signatures to try and break up California into multiple states (which would be a good thing) because they do not get enough representation in the state legislature because of population distribution issues.

 

They overturned that ballot initiative because it was an illegal proposition. Splitting up California violates the California Constitution and the United States Constitution. 
 

Prop 24 is on the ballot currently and is being voted on with mail in ballots right now. 

[Eaglerino]

13 hours ago, Orange1 said:

When you say out of Cali, yeeeup lots are leaving cali

just what the rest of America needs...

[Trik'Stari]

3 hours ago, DrMacintosh said:

They overturned that ballot initiative because it was an illegal proposition. Splitting up California violates the California Constitution and the United States Constitution. 
 

Prop 24 is on the ballot currently and is being voted on with mail in ballots right now. 

I'd continue this but I don't want to derail the thread.

[Donut417]

On 10/20/2020 at 10:17 PM, Delicieuxz said:

A lot more states have ballot initiatives than I realized.

Here in Michigan we vote on things for both state and local level. All school funding and local funding all has to be voted on. Weed is only legal here because they put it on the ballot, otherwise it would probably never have been made legal. 

[Delicieuxz]

Given privacy advocates' concerns about issues with the CPRA, I was kind-of hoping it wouldn't pass and that a new attempt that fixes its issues would be made. But it seems that it's on-track to be approved.

 

Election impact: Why the passing of California's Prop 24 matters for marketers and what to expect in 2021

 

Quoted from the article:

 

CPRA would:

• Create a broad category of "sensitive" personal data—a designation that includes such things as a person's racial or ethnic origin, their genetic data, their sexual orientation, and information about their health, among other information—which consumers can limit to approved uses.
• Give consumers the right to correct information businesses have on them.
• Strengthen opt-in requirements for data on children, with stronger penalties for forbidden use or sharing.
• Provide an opt-out for "cross-context behavioral advertising," defined in CPRA as targeted advertising based on users' personal information that was collected across a variety of digital touchpoints, such as websites, apps, and services.  

Why this matters for marketers:

• California is by far the largest state economy in the US, and the law would de facto become a national legal standard for most large advertisers.
• Laws to protect privacy will limit marketers' ability to personalize digital advertising. These laws also make data security more important, meaning that companies that use data will need to have more emphasis on data protection, introducing a new need for data protection officers, for example.
• A June 2019 Pew Research Center privacy survey found that 85% of US internet users had some concerns about how much information advertisers had about them, and nearly half of those (39%) had "a lot" of concern. A "yes" vote on Proposition 24 would set a standard for Congress and other state legislatures facing similar popular calls for privacy regulations.

What we can expect in 2021:

• If Prop 24 passes, as seems likely, it will create an unofficial deadline for a federal data privacy law. "I think that CPRA's most impactful provision is when it takes effect: January 2023," said Caitlin Fennessy, research director at the International Association of Privacy Professionals (IAPP). "If adopted, CPRA would create the impetus and provide the timeframe for adoption of federal privacy legislation. And I think that was intentional on the part of the ballot initiatives' proponents."