California privacy agency reaches out for support

Ashkan Soltani, the head of California's new online privacy regulator, needed help launching the first agency of its kind in the United States. So he called the state's Horse Racing Board.

Soltani asked Scott Chaney, executive director of the racing board, which oversees roughly 10 racetracks, about the ins and outs of running a small agency in California's sprawling state government. They discussed how to handle remote work and hiring in the pandemic. Chaney also offered advice for navigating the public sector.

Soltani is “literally inventing a state department,” Chaney said. “He's almost inventing it from the ground up.”

Soltani faces the daunting task of overseeing the first government body in the United States with the sole job of regulating how Google, Facebook, Amazon and other big tech companies collect and use data from millions of people. The office, the California Privacy Protection Agency, will be a more than 30-person group with a $10 million annual budget to help enforce the state's privacy law, which is among the most stringent in the country.

But first the agency has to be built — and Soltani, 47, a privacy expert who once served as the Federal Trade Commission's top technologist, has to overcome the lack of precedent. So he has reached out to groups not exactly adjacent to what his agency will be, like the racing board and others, for help navigating his new position.

He has already encountered challenges. He and his colleagues have received reams of feedback from industry lobbyists. They face questions from privacy activists about whether their budget is substantial enough to police the world's largest companies. The board discussions need to be open to the public. And in the coming months, they must translate the feedback they have received into hard rules.

“It's easily the most difficult thing I've done in my life, but also I think potentially the most impactful,” said Soltani, who has been working from his home in Oakland, California.

The new California agency reflects a larger shift in how the rules of the global internet are being set — and who is setting them. State capitals and foreign countries are taking a hands-on approach to limiting online data collection, curtailing the tech giants' power and moderating extreme content on social media.

They are filling a vacuum left by Congress. Lawmakers from both parties have long said they would support a national privacy law. But negotiations in Washington have stalled, partly because of a dispute over whether a federal law should supersede state laws. Like California, Colorado and Virginia have enacted privacy laws. Utah passed a privacy bill this month and other states are considering their own proposals.

Hayley Tsukayama, a legislative activist at the Electronic Frontier Foundation, said lawmakers around the country were closely watching California's developments. “We're hearing from lawmakers who are looking at bills and saying, `Do we need a privacy agency?' “she said.

California's Privacy Protection Agency stems from a 2018 state privacy law that gives residents the right to request their data from websites and have it deleted. The state attorney general was put in charge of creating rules under the law and suing companies that violated its terms. In 2020, privacy activists successfully campaigned to pass a ballot measure that added more provisions to the law and established the new agency to carry them out.