Last Thursday California Governor Jerry Brown signed into law the California Consumer Privacy Act of 2018 (CCPA), granting California consumers the right to request that businesses disclose the categories and specific pieces of personal information that they collect about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of 3rd parties with which the information is shared. The law, which goes into effect January 1, 2020, also authorizes California consumers to opt out of the sale of personal information by a business and will prohibit the business from discriminating against the consumer for exercising this right, including by charging the consumer who opts out a different price or providing the consumer a different quality of goods or services, except if the difference is reasonably related to value provided by the consumer’s data. Moreover, the CCPA makes it more difficult for businesses to sell personal information for consumers less than 16 years of age.
In enacting the law, the California legislature declared that while California is one of the world’s leaders in the development of new technologies, the proliferation of personal information has limited Californians’ ability to properly protect and safeguard their privacy. The legislature cited the misuse of tens of millions of people’s personal data by Cambridge Analytica.
According to the New York Times this is one of the most significant regulations overseeing data collection practices in the United States but is not as expansive as Europe’s General Data Protection Regulation (G.D.P.R.). According to Wired the bill passed unanimously in less than a week. It was rushed through to defeat a stricter ballot initiative that would have gone to voters if the bill had not passed. The New York Times explains that while the Internet Association, a tech industry group, views the new law as containing many problematic provisions, the group did not try to obstruct its passage because it viewed the ballot initiative as worse.
Additional Reading:
California Consumer Privacy Act of 2018
California Unanimously Passes Historic Privacy Bill (Wired)
California Passes Sweeping Law to Protect Online Privacy (New York Times)
California Passes Consumer Privacy Act (Ropes & Gray)
