Court: State can enforce data privacy ballot measure
Californians can now enforce a ballot measure that seeks to protect privacy rights by allowing consumers to stop businesses from using or selling information about their location, health, race, gender or other personal details, a state appeals court ruled Friday.
Proposition 24, approved by 56% of the voters in 2020, expanded state privacy laws, barred the Legislature from weakening the laws and established the California Privacy Protection Agency to enforce the measure and penalize businesses that violated it. It followed revelations that a datamining firm, Cambridge Analytica, had improperly obtained personal data of as many as 87 million Facebook users.
Prop. 24 was scheduled to take effect in July 2023. But when the new state agency failed to meet deadlines for some enforcement regulations, the California Chamber of Commerce argued, and a Sacramento County judge agreed, that the privacy protections could not be enforced until a year after the regulations were finally adopted.
The ruling required enforcement of the law to be delayed at least until July 2024, and possibly longer for regulations that have not yet been finalized. But the state’s 3rd District Court of Appeal in Sacramento said Friday that Prop. 24 could take effect immediately.
The delay would “disregard (Prop. 24’s) unambiguous provision setting forth a July 1, 2023, date for the commencement of enforcement,” Justice Elena Duarte said in a 3-0 ruling overturning the postponement ordered by Superior Court Judge James Arguelles.
“The voters intended to strengthen and protect consumers’ privacy rights regarding the collection and use (including sale) of their personal information,” Duarte wrote, and the ballot measure must be interpreted to follow their intention.
California voters added privacy rights to the state Constitution in 1972, and in 2018 approved a measure entitling consumers to know what personal information businesses were collecting about them and to prohibit sale of that information.
Prop. 24 went further by allowing consumers to correct inaccuracies in data held by businesses and to restrict use or disclosure of sensitive information. The Privacy Protection Agency can fine companies that violate the law.
The agency welcomed Friday’s ruling.
“The California voters didn’t intend for businesses to pick and choose which privacy rights to honor,” Michael Macko, the agency’s deputy director of enforcement, said in a statement. “We are pleased that the court has restored our full enforcement authority.”
“This is a good day for consumers’ privacy,” said Jamie Court, president of Consumer Watchdog, a nonprofit that supported Prop. 24. “Every day that our data is put in the public sphere, it becomes more dangerous for us.”
Court said Prop. 24 is the nation’s strongest consumer-privacy law, and that major companies doing business in California would most likely extend the same policies to their operations in other states.
The state Chamber of Commerce could ask the state Supreme Court to take up the case and overturn the ruling. Spokesperson Denise Davis said the chamber was considering its options.
She said the organization was pleased that the court agreed the state agency had failed to meet the legal deadlines for adopting Prop. 24 regulations, but was “disappointed that the Court of Appeal did not agree on a remedy.”