CCPA 2.0 Moves to Next Critical Stage of Referendum Process
In the evening of December 17, 2019, Californians for Consumer Privacy, the consumer privacy rights organization led by Alastair Mactaggart that propelled California towards the U.S.’s first comprehensive privacy legislation, tweeted the Attorney General’s release of the title and summary for Initiative 19-0021. This Initiative would substantively amend and essentially replace the California Consumer Privacy Act (“CCPA”) with the proposed Consumer Privacy Rights Act of 2020—also known colloquially as CCPA 2.0. The Attorney General summary highlights that the initiative would grant consumers the rights to “(1) prevent businesses from sharing personal information; (2) correct inaccurate personal information; and (3) limit businesses’ use of “sensitive personal information”—such as precise geolocation; race; ethnicity; religion; genetic data; union membership; private communications; and certain sexual orientation, health, and biometric information.” The summary also notes that it “changes criteria” for privacy law compliance, prohibits retention of personal information for longer than reasonably necessary, triples maximum penalties for violations of minors’ privacy rights, and establishes a new –and the first in the United States – regulator dedicated solely to privacy issues: the California Privacy Protection Agency. The summary also notes that the initiative would require the adoption of regulations, and highlights the millions of dollars cost to the state to create the new agency and enforce the law—a cost estimate that is offset by anticipated penalty revenues. The Attorney General summary also acknowledges that there is an “[u]nknown impact on state and local tax revenues due to economic effects resulting from new requirements on businesses to protect consumer information.” However, a review of the proposed text shows that the CPRA will do much more than merely require businesses to “protect consumer information”—an obligation that already exists through multiple laws and enforcement mechanisms. A Fiscal Impact Estimate Report is also available on the Attorney General’s website here.
The next step for the Initiative is to gather at least 623,212 signatures (based on 5% of the total votes cast in the last gubernatorial election) by late June—just before the Attorney General is likely set to begin enforcement of the CCPA.
As noted in a letter from Mactaggart on the Californians for Consumer Privacy website, the CPRA “would enshrine these rights by requiring that future amendments be in furtherance of the law, even though … [the CPRA sets] the threshold to amend at a simple majority in the legislature. While amendments will be necessary given how technically complex and fast-moving this area is, this approach respects the role of the legislature while still providing substantial protections for Californians from attempts to weaken the law and their new human rights.”
