Where Are We Now? – Taking Stock of CCPA Amendments After May 31 Legislative Deadline
Key Points
- May 31, 2019, was the deadline for the California Legislature to pass bills out of the chamber in which they were introduced. Several measures proposing amendments to the California Consumer Privacy Act (CCPA) passed the state Assembly and now await action in the Senate.
- September 13, 2019, is the last day for any bill, including those containing CCPA amendments, to be passed this year. Negotiations have already begun regarding changes to CCPA amendments passed by the Assembly to try and ensure passage by the Senate.
- Below, we provide a practical summary of pending CCPA amendments and highlight those of particular importance. Pending CCPA amendments would, among other things, effectively remove employees from the definition of consumer, explicitly exempt deidentified and aggregate information from the definition of personal information, and exclude customer loyalty programs from certain CCPA provisions.
I. Introduction
The California Consumer Privacy Act (CCPA) was drafted and passed in a little over a week in the summer of 2018. Drafters were rushing to stave off the possibility of a ballot initiative. The rushed drafting and passage process led to a final law rife with internal inconsistencies and grammatical errors. It also limited the ability of both industry advocates and privacy activists to provide thoughtful input regarding the practical effects of certain passages and limited their ability to propose effective revisions. Initial amendments passed in September 2018 fixed a few substantive and technical issues, but left many issues unresolved.
In 2019, a number of bills were introduced in the California Assembly and Senate to amend the CCPA to help address some of these outstanding issues. These bills proposed amendments ranging from significant substantive changes like an expansion of the private right of action (SB-561, now dead), to more operational revisions like enabling businesses to use an email address in addition to other means to collect consumer requests for information under the CCPA (AB-1564, now before Senate). Which of these amendments the Senate passes, and any changes it makes to the same, could impact the scope and some requirements of the CCPA.
II. Overview and Chart of Key CCPA Amendments Still in Play
As noted above, a number of measures proposing amendments to the CCPA passed the Assembly and are now awaiting action in the Senate. These bills must now be heard in Senate policy committees by July 12 and must be passed by both houses by September 13 in order to be eligible for the governor to sign into law by October 13.
Of the amendments that passed, the following are arguably the most significant in terms of their potential effect on the business community.
- Employee Information: AB-25 – This would revise the definition of “consumer” to exclude from that definition a job applicant, employee, contractor or agent of a business only to the extent their personal information is collected and used solely within that role. Should this bill pass in its current form, this would effectively remove direct employees (and others) from the scope of the CCPA. It is less clear if this measure would also exclude information collected or used as a result of business-to-business relationships.
- Loyalty Programs: AB-846 – This would clarify that the CCPA’s nondiscrimination provision does not apply to reward or loyalty programs to which a consumer voluntarily provides their personal information if the program meets certain requirements.
- Deidentified and Aggregate Information: AB-874 & AB-1355 – These would, among other things, clarify that deidentified information and aggregate information are excluded from the definition of personal information.
- Information Provided to Government Agencies: AB-1416 – This would exclude from certain provisions of the CCPA: (1) a business that provides a consumer’s personal information to a government agency solely for the purpose of carrying out a government program; and (2) a business that sells the personal information of a consumer who has opted out of the sale of the consumer’s personal information to another person solely for security purposes.
- Methods of Receiving Consumer Requests: AB-1564 – This would permit a business to utilize an email address in addition to a physical address to receive consumer requests under the CCPA. Online-only businesses need only provide an email address.
The following chart provides a brief description of the CCPA amendments that remain pending, along with their current status. Changes to these bills are ongoing and nothing in this chart should be taken as a final description of the contents or as an indication of the likelihood of final passage of these measures.
Bill (Author) |
Status and Key Dates |
Description |
|
AB-25 |
5/29: Passed Assembly (77-0-3). 5/30: Read first time in Senate, referred to Rules for assignment. |
Would exclude from definition of consumer in Section 1798.140(g) people whose information is collected while they are a job applicant, employee, contractor or agent of a business only to the extent their personal information is collected and used solely within that role. Adds a definition of “contractor.” Contains language indicating legislative intent to revise provisions on specific pieces of information. |
|
AB-846 |
5/28: Passed Assembly (69-4-7). 5/29: Read first time in Senate, referred to Rules for assignment. |
Would add a new section to the CCPA (§ 1798.126) that exempts differential treatment pursuant to a consumer’s voluntary participation in a customer loyalty/rewards program from the CCPA’s general nondiscrimination provision. (See § 1798.125).) |
|
AB-873 |
5/22: Passed Assembly (73-0-7). 5/29: Referred to Senate Judiciary. |
Would revise the definition of personal information to be information that “identifies, relates to, describes, is reasonably capable of being associated with . . . .” (See § 1798.140(o)(1).) Would revise the definition of “deidentified” to mean information that is not “reasonably linkable . . . .” (§ 1798.140(h).) Would change the limitations placed on a business that uses deidentified information to the following: (1) ensure data deidentified; (2) publicly commit to maintain and use data in deidentified form; (3) contractually prohibit recipients of data from trying to reidentify data. |
|
AB-874 |
5/9: Passed Assembly 5/9 (76-0-4). 5/22: Referred to Senate Judiciary. |
Would revise the definition of “publicly available” to eliminate the requirement that information be used for same purpose as it was originally created for in order to fall within the definition. (See § 1798.140(o)(2).) Would add a new subsection to clarify that deidentified information and aggregate information are not “personal information.” (See new § 1798.140(o)(3).) |
|
AB-981 |
5/22: Passed Assembly (on consent calendar). 5/29: Referred to Senate Judiciary and Senate Insurance. |
Would add a new exemption to eliminate a consumer’s right to request a business delete or refrain from selling the consumer’s personal information under the CCPA if it is necessary to retain or share the consumer’s personal information to complete an insurance transaction requested by a consumer. (See new § 1798.145(f).) |
|
AB-1146 |
5/23: Passed Assembly. 5/24: Read first time in Senate, referred to Rules for assignment. |
Would add a new exemption to permit information sharing between a new motor vehicle dealer and the vehicle’s manufacturer if the information is retained or shared pursuant to, or in anticipation of, a vehicle repair relating to warranty work or a recall. (See new § 1798.145(g).) |
|
AB-1202 |
5/28: Passed Assembly (56-13-11). 5/29: Read first time in Senate, referred to Rules for assignment. |
This is a standalone bill concerning data brokers that cross-references and incorporates some CCPA requirements. Would require data brokers to meet certain requirements, including registering with the California Attorney General’s Office; enabling consumers to exercise their rights under the CCPA, including to opt-out of the sale of their personal information; disclose certain information to consumers; etc. “Data broker” means a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, with certain defined exceptions. |
|
AB-1355 |
5/9: Passed Assembly (76-0-4). 5/22: Referred to Senate Judiciary. |
Would carry out various technical fixes to clarify or fix language in multiple CCPA provisions. In particular, would fix the CCPA’s nondiscrimination provision to clarify that it is the value of the information to the business, not the consumer, that matters. (See § 1798.125(a)(2).) Would clarify that a consumer’s right to request specific pieces of information must be disclosed in a business’s online privacy policy, and opt-in consent is required to sell the personal information of children less than 16 years old. Would clarify that deidentified information and aggregate information are not personal information. (See § 1798.140(o)(2).) |
|
AB-1416 |
5/29: Passed Assembly (47-17-16). 5/30: Read first time in Senate, referred to Rules for assignment. |
Would exclude from certain provisions of the CCPA: (1) a business that provides a consumer’s personal information to a government agency solely for the purpose of carrying out a government program; and (2) a business that sells the personal information of a consumer who has opted out of the sale of the consumer’s personal information to another person solely for security purposes (i.e., detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity). |
|
AB-1564 |
5/13: Passed Assembly (73-0-7). 5/30: Read first time in Senate, referred to Rules for assignment. |
Would revise the provisions dictating the means by which businesses may permit consumers to submit requests under the CCPA to permit businesses to make available an email address together with a physical mailing address, as well as a toll-free telephone number. Businesses that operate exclusively online need only provide an email address. (See § 1798.130(1)(A).) |
Contact Information
If you have any questions concerning this alert, please contact:
|
Natasha G. Kohne |
Dario J. Frommer |
|
Michael J. Stortz |
Diana E. Schaffner |
