Gov. Gavin Newsom has signed five bills aimed at easing tech and business complaints about California’s first-in-the-nation privacy law before it takes effect Jan. 1, 2020.
Newsom (D) signed the measures making minor changes to the California Consumer Privacy Act Oct. 11, one day after Attorney General Xavier Becerra (D) issued a draft version of regulations that businesses must follow to comply with the law.
The CCPA will give consumers the right to ask a company what data it holds on them and to have that data deleted, as well as to opt out of the sale of their personal information. The law limits how Alphabet Inc.'s Google and other companies collect and make money from user data online.
Newsom signed bills to exempt public information and employee information held by employers from the law, specify communication methods companies must offer to consumers to make requests about their data, and allow carmakers to keep customer data if it’s necessary for repairs or warranty work.
The definition of “personal information” now exempts information that employees share between businesses providing services to each other. Another change clarifies that companies don’t have to collect consumer data or retain it longer than they would in the normal course of business.
Groups including the California Chamber of Commerce and Internet Association sought the changes.
The signed bills are:
- A.B. 25 by Assemblyman Ed Chau (D) to exempt personal information employers have about their employees from the law’s requirement that it be disclosed or deleted upon request;
- A.B. 874 by Assemblywoman Jacqui Irwin (D) to clarify how public information is exempt from the law;
- A.B. 1146 by Assemblyman Marc Berman (D) to limit opt-out and deletion rights for data held by car dealers necessary for repair and warranty work;
- A.B. 1355 by Chau to make multiple technical changes; and
- A.B. 1564 by Berman to specify that businesses must provide an email address, but not a toll-free number, for consumers to request information.
The new laws take effect Jan. 1, 2020, at the same time as the broad privacy law.