California Legislature Passes Amendments to Sweeping Consumer Privacy Act

Yesterday, California Governor Jerry Brown signed SB 1121 into law amending the California Consumer Privacy Act of 2018 (“CCPA”). Since the original CCPA (previously discussed here) was passed in June, interested parties have criticized many aspects of the law and advocated for pre-implementation improvements. SB 1121 is intended to correct many of those issues.

CA Attorney General Becerra’s Letter Prompts Legislative Action

SB 1121 was drafted partly in response to a letter sent by the California Attorney General (“AG”) Xavier Becerra to Assembly member Ed Chau and Senator Robert Hertzberg on August 22, 2018. The letter argued that the CCPA imposed several unworkable obligations and posed serious operational challenges to the AG’s office (“AGO”), the agency charged with its oversight and enforcement.  The letter set forth the following primary concerns:

  • The CCPA required the AGO to provide an opinion to “any business or third party” as well as warnings to a business before they could be held accountable for a violation of the CCPA. The AG argued that such a requirement essentially obligated using public funds to provide unlimited legal advice to private parties.
  • There are California constitutional issues that could prohibit the CCPA’s modification of the Unfair Competition Law’s penalty provision through such legislation.
  • The CCPA contained an unnecessary requirement that private plaintiffs give notice to the AG before filing suit. The AG argued that this provision has no purpose as the courts, not the AG, decide the merits of private lawsuits.
  • The AGO had one year to conduct rulemaking for this newly established body of law, but the CCPA provided no resources for the AGO to carry out this rulemaking or even its implementation thereafter. The AG further argued that a one-year deadline to establish implementing regulations for the CCPA was unattainable.
  • The CCPA did not include a private right of action that would allow consumers to seek legal remedies for themselves to protect their privacy. Instead, the Act included a provision that gave consumers a limited right to sue only after a data breach. The AG urged the legislature to provide consumers with a more robust private right of action under the CCPA.

How SB 1121 Modifies the CCPA

SB 1121 largely preserves the substance of the CCPA, but contains the following changes:

Enforcement Grace Period.  Pushes the AGO’s deadline to adopt regulations back to July 1, 2020 and AGO enforcement until six months thereafter or July 1, 2020, whichever is sooner. This change may buy businesses up to an additional six months depending on how long it takes to promulgate regulations. However, covered businesses must start tracking data and data practices beginning January 1, 2019.

Exemptions for Health Providers.  Fully exempts data handled pursuant to the Gramm–Leach–Bliley Act and Driver’s Privacy Protection Act. The bill also clarifies that the CCPA does not apply to healthcare providers and other entities governed by HIPAA.

Notifying the AGO of Private Lawsuits.  Deletes the requirement for private plaintiffs to notify the AGO before bringing a private lawsuit stemming from a data breach.

Civil Fines.  Makes it clear that the AGO may seek penalties of up to $2,500 for each violation of the CCPA, and $7,500 for intentional violations.

First Amendment Exemptions.  Clarifies that the CCPA’s consumer rights and business obligations do not apply to the extent they infringe on non-commercial activities of the press. The law remains vulnerable to the extent it infringes upon other activities protected under the First Amendment.

Technical Edits.  Makes several edits to fix obvious drafting errors and address other technical issues.

Disclosure of Deletion Rights.  Requires businesses to disclose a consumer’s deletion right “in a form that is reasonably accessible to consumers” but now allows businesses to redirect California consumers to separate policies specifically applicable to them.

It’s important to note that SB 1121 will address some, but not all, of the AG’s concerns. It’s likely the AG will seek additional amendments during the 2019 legislative session. Businesses will continue to advocate for CCPA amendments and clarifications as well. M&S will continue to provide updates along the way.

* Ali Najaf coauthored this post.