Gov. Brown signs sweeping consumer privacy legislation
The Legislature and Gov. Jerry Brown approved sweeping new protections for consumers’ online data Thursday amid news of a massive new security breach, a move that will keep a competing initiative opposed by the technology industry off the ballot.
The California Consumer Privacy Act, Assembly Bill 375 by Assemblymember Ed Chau, D-Monterey Park, and state Sen. Robert Hertzberg, D-Van Nuys, passed unanimously out of the Assembly and Senate with bipartisan support Thursday. Brown signed it a few hours later. It takes effect in 2020.
Hertzberg said the bill will offer groundbreaking protections for consumers to know what data is collected on them, opt out of collection and hold companies accountable for unauthorized release of their information.
“There’s a whole new meaning to what privacy is about in this era of the internet,” Hertzberg said. “We in California are taking a leadership position with this bill. I don’t think there is a question this will be the most farreaching privacy bill across the country. I think it will serve as inspiration across the country.”
Voting on the new law came amid news that Exactis, a Florida-based marketing and data-aggregation firm, reportedly leaked detailed information on individual adults and businesses involving as many as 340 million records on a publicly available server.
Itwas the latest in a series of failures by various companies to protect consumers’ data that polls show are driving support for regulation. Facebook CEO Mark Zuckerberg acknowledged in March that the socialmedia giant had failed its users after reports that British political consulting firm Cambridge Analytica had harvested up to 87million Facebook users’ profiles without their consent.
Other companies that acknowledged major data breaches include Uber in November affecting 57 million users, Yahoo in October affecting 3 billion users, Equifax in September affecting 148 million users, LinkedIn in 2016 affecting 100million users, and Anthem in 2015 affecting 80 million users.
The bill was sponsored by advocacy group Common Sense and supported by privacy activist Alastair Mactaggart, who had launched a ballot initiative under the same name that qualified for the November ballot this week. It was Mactaggart’s success in qualifying the ballot initiative that forced the legislature to act, and the companies who had opposed his initiative to stay on the sidelines. Polls showed overwhelming support for the measure.
Mactaggart, a San Francisco real estate developer who has spent $1.65 million on the initiative campaign, with drew the ballotmeasure Thursday — the last day he could do so — after the Legislature and governor approved the bill. He said the bill and initiative “both accomplish the same goals broadly.”
“This is a monumental achievement for consumers, with California leading the way in creating unprecedented consumer protections for the rest of the nation,” Mactaggart said.
An initiative approved by voters can only be changed by voters, but lawmakers can modify a bill they approved in the Legislature, making it easier to tweak the lawto fix unintended consequences.
“By doing a bill, we preserve the legislative process going forward,” Sen. Anthony Portantino, D-La Cañada Flintridge, said before Thursday’s vote.
The bill mirrors three core components of the ballot initiative: the right to know what data is being collected, to opt out of that collection, and to hold companies liable for data breaches.
A key difference concerns consumers’ right to sue companies for violations. The initiative would have allowed lawsuits for all violations of the proposed measure, while the bill limits lawsuits to data breaches, with other violations subject to enforcement by the state attorney general.
But advocates said that in return for limiting lawsuits, the bill expands other protections. It gives consumers the right to know all personal information a company collects on them for free twice a year and the right to delete it. It also requires an opt-in to collect data on children under 16 years old.
Industry leaders, including the Silicon Valley Leadership Group, which represents major technology firms, had opposed the ballot measure, arguing it went too far and was approved without industry input. Peter Leroe-Muñoz, the Silicon Valley Leadership Group’s vice president of technology and innovation, said last week that the group had taken no position on the bill.
Will Castleberry, Face- book’s vice president of state and local public policy, said in a statement Thursday that “while not perfect, we support AB 375 and look forward to working with policymakers on an approach that protects consumers and promotes responsible innovation.”
“We are committed to being clear with people about howour services work,” Castleberry said, “including the fact that we do not sell people’s data.”
TechNet, a tech industry trade group whose members include Google and Facebook, said in a statement Thursday: “It is critical that the business community, consumer groups, and the legislature work together over the next 18 months to improve this law so it provides meaningful privacy protections for Californians while also allowing all the benefits and opportunities consumers expect from U.S. technology to continue.”
Polls indicate broad support for data privacy regulation.
A new poll commissioned by the Campaign for Accountability, a Washington, D.C.-based liberal watchdog, found 77 percent of Americans believe that big internet and technology companies have a negative impact on privacy. In addition, 73 percent of those polled believe there should be more regulation of the companies. The national phone poll of 1,001 registered voters was conducted from June 11-19.
A May poll sponsored by the Bay Area News Group and Silicon Valley Leadership Group found a majority of voters in the technology industry’s Bay Area base would support new government regulations on data security and privacy.