IT PASSED!!!: California approves strong data privacy rights opposed by ISPs and tech companies

[Delicieuxz]

 

California approves privacy rules opposed by ISPs and tech companies

 

Quote

 

California is imposing a privacy law giving consumers more control over how their personal data is collected, used, and sold by corporations. Broadband providers, tech companies, and advertising groups had been fighting against a ballot initiative that contained consumer protections similar to what's in the new law.

 

The California Consumer Privacy Act of 2018 was approved unanimously by the state Senate and Assembly today and was signed by Gov. Jerry Brown.

 

A legislative bill summary says the law will give Californians "the right to know what PI [personal information] is being collected about them and whether their PI is being sold and to whom; the right to access their PI; the right to delete PI collected from them; the right to opt-out or opt-in to the sale of their PI, depending on age of the consumer; and the right to equal service and price, even if they exercise such rights."

 

The bill is set to take effect on January 1, 2020. Businesses could be penalized up to $7,500 for each violation.

 

Personal information is defined as anything that is "capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." This includes Internet browsing and search history, biometric data, geolocation data, job and education information, and various types of identifiers such as names, aliases, postal addresses, Internet Protocol addresses, email addresses, account names, Social Security number, driver's license numbers, and passport numbers.

 

Anything that is otherwise publicly available would not be protected by the law.

 

Consumers would have the right to request all the data collected about them from a business up to twice a year, and businesses would be required to disclose the information free of charge. Consumers would have "the right to request that a business delete any PI about the consumer which the business has collected from the consumer."

 

Businesses that sell consumers' personal information to third parties would have to let people opt out of those sales at any time. The rule is stricter for children, as businesses would not be allowed to sell personal information related to people under the age of 16 unless they receive an "opt-in" from the child or child's parent or guardian. The parent or guardian's consent would be needed for children under the age of 13.

 

Businesses would also be prohibited "from discriminating against a consumer because the consumer exercised any of the consumer's rights under this bill, such as by charging different prices or rates, or providing a different level or quality of goods or services."

 

"Google executives have warned that the measure could have unintended consequences but have not said what those might be," Reuters wrote. "The Internet Association, which also represents Facebook and Amazon, has also opposed the bill, as have the California Chamber of Commerce and the Association of National Advertisers."

 

 

This is a fantastic development for individuals and privacy advocates. It means that we will have much greater insight into who is doing what with our data, because companies will have to reveal all that information to Californians, making it public for everybody.

 

Also, for those who can't stand the obscene amounts of personal data that Microsoft harvests through Windows 10 even at the most minimal settings, I think this new regulation should mean there will have to be a way for (at least Californian) Windows owners to completely disable all non-security data collection.

 

 

Quote

The ballot question was opposed by Amazon, Facebook, Google, Microsoft, Uber, Comcast, AT&T, Cox, Verizon, and several advertising lobby groups, all of whom donated to a campaign against the initiative.

 

ISPs successfully lobbied Congress to prevent implementation of broadband privacy rules last year. At the time, ISPs argued that they shouldn't have to face different rules than Google and Facebook. But they opposed the California rules even though they apply equally to ISPs and other tech companies.

This gives you some insight into who are selling your personal data for profit.

 

Quote

"State-specific laws will stifle American innovation and confuse consumers," said CTIA, the mobile broadband industry's lobby group, according to Reuters.

The solution is to apply these regulations ubiquitously to other states and countries. And that's the direction I expect things to head.

 

 

 

Sweeping California consumer privacy bill approved by Jerry Brown

 

"I feel like it's the first step, and the country's going to follow," Mactaggart said. "Everybody is finally waking up to the importance of digital privacy."

 

"The bill also allows individual consumers to sue companies for up to $750 if there is an unauthorized breach of their non-encrypted personal information, despite being written with broader language to give tech companies more legal cover. While consumers can sue for security breaches, the attorney general can levy fines."

 

 

 

And here is live video footage from around the galaxy right now:

 

 

 

I previously posted about this initiative in this thread, and gave examples of which people will likely find the matter relevant and important to them:

 

 

[SansVarnic]

Wow 1 thing California did right... Im floored.

 

(not intentionally meant to be a political comment)

Edited June 29, 2018 by SansVarnic

[Arika]

10 minutes ago, Delicieuxz said:

The bill is set to take effect on January 1, 2020.

so they basically have free reign for the next year and a half and give these companies time to appeal the decision before they have to abide by it. so everyone in california is goin to have absolutely everything collected about them in this next year and a half so these companies have a backlog of sellable data

 

Quote

ISPs successfully lobbied Congress to prevent implementation of broadband privacy rules last year. At the time, ISPs argued that they shouldn't have to face different rules than Google and Facebook. But they opposed the California rules even though they apply equally to ISPs and other tech companies.

lol that backfired on them

[DrMacintosh]

The Great State of California is at it again!

[DrMacintosh]

5 minutes ago, SansVarnic said:

Wow 1 thing California did right... Im floored.

 

(not intentionally meant to be a political comment)

Yeah, I was about to PM you about that. Especially with you being a mod, it reflects badly on the forum. 

[Drak3]

1 minute ago, DrMacintosh said:

Add this to the list of things California does right.

List of things California does right:

• Internet Privacy
• That's it.

[Brooksie359]

1 minute ago, DrMacintosh said:

Yeah, I was about to PM you about that. Especially with you being a mod, it reflects badly on the forum. 

I mean it really is about how you read the comment. They didn't say only they just said one. 

[orbitalbuzzsaw]

GDPR Lite,  USA edition

[Delicieuxz]

4 minutes ago, Sierra Fox said:

so they basically have free reign for the next year and a half and give these companies time to appeal the decision before they have to abide by it.

Can it still be appealed or modified after it has been signed by the Californian governor?

 

4 minutes ago, Sierra Fox said:

so everyone in california is goin to have absolutely everything collected about them in this next year and a half to these companies have a backlog of sellable data

I understand the 1.5 years lead time for the law to take effect. These companies' software is currently not designed to accommodate these new regulations, and it will take some time for them to adapt both their software and their business models to be ready for the new regulations.

[Delicieuxz]

30 minutes ago, orbitalbuzzsaw said:

GDPR Lite,  USA edition

Is it lite? It looks more resolute and encompassing than GDPR, to me.

 

I'm not well versed on GDPR. Does it entitle people to differentiate between the collection and the sale of their data in their preferences, and also to the right to equal service and price regardless of their choice?

 

Edit: And also who their data is being sold to?

[JoeCoke]

Wow California, you did something right...

 

Well, the future looks a bit brighter now. Microsoft, Google and Facebook are pretty unhappy right about now.

[Arika]

7 minutes ago, Delicieuxz said:

Can it still be appealed or modified after it has been signed by the Californian governor?

given that internet neutrality was repealed, then was reversed and repealed again in the space of a couple of months, absolutely.

[orbitalbuzzsaw]

Personally I'm just waiting for them to declare independence before I move

[orbitalbuzzsaw]

9 minutes ago, Delicieuxz said:

Is it lite? It looks more resolute and encompassing than GDPR, to me.

 

I'm not well versed on GDPR. Does it entitle people to differentiate between the collection and the sale of their data in their preferences, and also to the right to equal service and price regardless of their choice?

I'm not sure but I believe it does not. More GDPR Redux i guess

[Delicieuxz]

2 minutes ago, Sierra Fox said:

given that internet neutrality was repealed, then was reversed and repealed again in the space of a couple of months, absolutely.

Interesting point.

 

Although, this privacy regulation act was passed by California's senate unanimously, 36 in-favour to 0 against. It wouldn't be easy to get support to repeal it. And once the new regulations are active, the public won't easily accept giving up their established rights.

[Arika]

2 minutes ago, Delicieuxz said:

Although, this privacy regulation act was passed by California's senate unanimously, 36 in-favour to 0 against. It wouldn't be easy to get support to repeal it. And once the new regulations are active, the public won't easily accept giving up their established rights.

one can only hope.

 

the companies that oppose it have a lot of money and California has no water

[orbitalbuzzsaw]

1 minute ago, Delicieuxz said:

Interesting point.

 

Although, this privacy regulation act was passed by California's senate unanimously, 36 in-favour to 0 against. It wouldn't be easy to get support to repeal it. And once the new regulations are active, the public won't easily accept giving up their established rights.

Then again, it's possible the Federal Ruining-Things Commission might  try to fight it

[Christophe Corazza]

Now all of the other states need to follow California’s example...

[orbitalbuzzsaw]

1 minute ago, Christophe Corazza said:

Now all of the other states need to follow California’s example...

As usual I might note

[SansVarnic]

21 minutes ago, DrMacintosh said:

Yeah, I was about to PM you about that. Especially with you being a mod, it reflects badly on the forum. 

Yeah i wasnt necessarily referring to the political aspect so much but after I posted I re-read and thought yeah I should disclaimer before someone takes that angle. Lol.  

[DrMacintosh]

4 minutes ago, orbitalbuzzsaw said:

it's possible the Federal Ruining-Things Commission might  try to fight it

Make them do it. Can't wait to chant "States Rights" at the feds. 

[potoooooooo]

Did they pass the full version or the gutted version?

[orbitalbuzzsaw]

1 minute ago, DrMacintosh said:

Make them do it. Can't wait to chant "States Rights" at the feds. 

Yeah same. Personally I'm just waiting for you guys to declare independence before I move

[Drak3]

8 minutes ago, orbitalbuzzsaw said:

As usual I might note

If that happened, the US would be a shit hole.

 

9 minutes ago, Christophe Corazza said:

Now all of the other states need to follow California’s example...

Exclusively in this case.

[Delicieuxz]

7 minutes ago, potoooooooo said:

Did they pass the full version or the gutted version?

They passed a slightly-modified, though still robust version.

 

The Ars article mentions these differences between the proposed and the passed legislation:

Quote

The bill differs from the initiative in the way that companies would be held accountable for breaches to address an industry concern. The ballot measure exposed companies to litigation regardless of the state attorney general's action. The bill would allow the attorney general to levy fines for data breaches, after which consumers could then sue over them.

 

The bill also adds provisions that go beyond the ballot measure, like requiring parental consent for companies to sell data on children younger than 16. And it would include provisions of Europe's privacy laws such as consumers' right to compel companies to delete all their private data.

 

Mactaggart said in an interview last week that "they both accomplish the same goals broadly."

 

The passed legislation apparently still allows for the suing of companies, though:

 

https://www.sacbee.com/news/politics-government/capitol-alert/article213993229.html

Quote

The bill also allows individual consumers to sue companies for up to $750 if there is an unauthorized breach of their non-encrypted personal information, despite being written with broader language to give tech companies more legal cover. While consumers can sue for security breaches, the attorney general can levy fines.

 

I don't know if there are other differences between the proposed and the passed legislation.

 

The American Civil Liberties Union seems to be unsatisfied with the passed version:

Quote

The ACLU said the new law "utterly fails to provide the privacy protections the public has demanded and deserves."