5 JULY 2018
The California Governor, Jerry Brown, signed and enacted into law, on 28 June 2018, The California Consumer Privacy Act of 2018 (AB 375) (‘the Act’), after it was passed unanimously by both houses of the California State Legislature on the same day. The Act, which will come into effect on 1 January 2020, applies to for-profit legal entities doing business in California that collect consumers’ personal information and that satisfy one or more conditions under the Act, namely, having an annual gross revenue in excess of $25 million, handling the personal information of 50,000 or more consumers, households, or devices, and derive more than 50 percent of their annual revenue from selling consumers’ personal information.
Marina Gatto, Associate at Perkins Coie LLP, told DataGuidance, “The Act is the broadest generally applicable privacy law passed in the country and arguably creates new privacy rights for California residents. Once the Act goes into effect, companies will likely face increased volumes of consumer requests regarding their personal information, and also be subject to private rights of action for violations of its provisions.”
Under the Act, consumers have the right to request companies to disclose the categories and specific pieces of personal information that are collected, as well as to delete personal data that the company holds. The Act also provides consumers with the right to opt out of the sale of personal information by a company to third parties. Moreover, should consumers’ personal data be affected by a breach resulting from a company’s failure to implement and maintain reasonable security procedures and practices to protect the personal information, the Act provides consumers with a private right of action to recover damages, among other relief.
Companies will likely face increased volumes of consumer requests regarding their personal information, and also be subject to private rights of action for violations of the law
Gatto noted, “There are shortcomings with the Act as a result of it being fast-tracked […] given the short period of consideration, there was little time for valuable input that could have been obtained from all stakeholders. While the language of the Act is generally an improvement over the prior initiative that was going to be placed on the November 2018 ballot, there remain ambiguities into how it will apply.”
The separate ballot initiative, also known as the California Consumer Privacy Act of 2018, which also sought to establish new consumer privacy rights and that was set to be voted on in November 2018, was withdrawn on 28 June 2018. The Act required the initiative to be withdrawn for it to become operative.
Gatto concluded, “We have already started to see other states and jurisdictions introducing similar legislation. The City of Chicago introduced a Data Collection and Protection Ordinance, and Vermont has already enacted the Act Relating to Data Brokers and Consumer Protection (Act No. 171 2018). We would not be surprised to see similar efforts in other states and jurisdictions.”
PASCALE ARGUINARENA and BART VAN DER GEEST Privacy Analysts