California Privacy Agency Ramps Up Work With Unannounced Probes

The California Privacy Protection Agency is currently in the middle of multiple, undisclosed investigations, beyond the one probe of automakers that’s been publicly announced, said the agency’s executive director Ashkan Soltani at a privacy conference on Thursday.

The fledgling agency, which gained powers this past July to enforce the state’s comprehensive privacy law, had announced that it was looking into the privacy practices of connected cars, such as those with in-vehicle cameras or smartphone integration. This is the only public enforcement action from the agency.

“While the (auto) inquiry’s public, that’s not the only thing we’re looking into,” Soltani said. “We have plenty of other investigations underway, in other industries, other businesses, other privacy concerns.”

Soltani said he couldn’t go into specifics, but he mentioned the agency’s enforcement priorities that are serving as the basis for those new investigations. Those priorities are privacy notices and policies, the right to delete, and responses from businesses to consumer privacy rights requests.

Soltani also noted that the agency’s current and future enforcement decisions are being informed by complaints it receives.

Connected Car Inquiry

The focus of the agency’s announced automaker investigation won’t just be on the car companies, but also third-party services that use car-collected data, Soltani added. The agency will also question whether effective notices are given to consumers about the technology in their cars, because it’s uniquely hard for cars to provide opt-out options or other privacy actions to inform drivers as opposed to a website.

“The goal of the sweep is to really understand what businesses are doing and what business practices are in this area, and how they’re complying,” he said.

The activity comes despite an enforcement team that’s not fully staffed. Soltani said the agency is actively recruiting for enforcement positions.

The agency’s enforcement powers, however, have been delayed in a court battle brought by businesses. A judge ruled earlier this year that only the privacy statute is enforceable—and not the agency’s subsequent regulations—due to lateness in finalizing its rules. The agency is appealing that decision.

Soltani criticized the decision, saying not only did it harm consumers but it also affected businesses that had taken proactive steps to comply with the new regulations.

Now, those businesses are in an uncertain position, he said.

With more time for businesses to comply with the regulations, Soltani said, scrutiny could be higher come March, when regulations are enforceable under the ruling.