Business groups aired their concerns about California’s landmark privacy law at a public hearing in Sacramento, as they work to shape both implementing regulations and a likely follow-up bill.
The Feb. 5 hearing conducted by Attorney General Xavier Becerra’s staff was one of several being held before Becerra (D) issues regulations under the California Consumer Privacy Act.
The law, which takes effect Jan. 1, 2020, gives consumers the right to ask a company what data it holds on them and to delete that data, as well as to opt out of the sale of their personal information. Becerra must have regulations in place by July 1, 2020, governing some aspects of the law.
Business groups and employers across a variety of sectors, including tech, retail, education, and entertainment, participated in the hearing. The groups want Becerra to clarify what personal information falls under the law; whether de-identified personal data businesses hold on consumers must be re-identified to link it back to a consumer who has requested it; and whether and how businesses can require that they verify the identity of consumers who ask for their data to prevent fraud.
Business groups also asked whether businesses can offer a range of options to opt out of data sharing or selling rather than a blanket opt out; whether a consumer’s right to ask that their data be deleted also applies to employers and their employees’ data; and how the prohibition on discrimination against consumers who opt out of sharing will work, especially for customer loyalty programs.
“Overly broad definitions might result in inconsistent application of the law and defeat its purpose,” Pete Isberg, president of the National Payroll Reporting Consortium, said.
Consumer groups pushed back against some of the business groups’ concerns, opposing any rules that make it difficult for people to opt out or result in consumers having to pay more for services after opting out.
“Financial incentives offered by businesses should be tied to the average value of customer data to allow loyalty programs to continue while not charging unreasonable rates for use of services,” James Harrison, an attorney with Remcho Johansen & Purcell LLP representing Californians for Consumer Privacy, said.
The group, lead by real estate investor Alastair Mactaggart, was the primary backer of the CCPA.
The California legislature is likely to enact new legislation to amend the CCPA before Becerra issues his draft regulations. Assemblyman Ed Chau has introduced a bill (A.B. 25) that could include some changes.
The existing law directs Beccera’s office to develop a uniform opt-out logo and button for businesses to offer to online consumers, and provide advice about compliance with the law upon request.
Becerra is asking for input about the opt-out button, as well as how to define personal information and unique identifiers. He also is asking whether some exemptions are necessary, and how business can comply with consumer requests.
Becerra won’t be issuing the draft regulations until the fall, giving lawmakers time to pass another bill first. Business and consumer groups have been working on legislative fixes since the law was enacted in 2018.