The California Consumer Privacy Act is a flawed piece of legislation do to the rushed enactment process. The California State Legislature has been trying to cure the flaws since it enacted the “CCPA” in the summer of 2018. The Legislature just considered the CCPA final amendments for the year. Let’s take a look at what the Legislature did and did not pass. I’m going to hit these amendments quick and dirty, so feel free to contact me for more detail on each bill.
The California Legislature passed six amendments to the CCPA in September 2019, while rejecting one. For clarification purposes, the “AB” in the following definitions is an abbreviation for “Assembly Bill.” You can find the bills by searching here.
The original version of the CCPA contains no exceptions for data companies collect on their employees – resumes, performance reports, etc. The Legislature passed AB 25, which exempts most personal information businesses collect from job applicants, employees, owners, officers, medical staff, and contractors to the extent the company uses the information solely in relation to the person’s role with the company.
The Legislature essentially kicked the can down the road with AB 25. The amendment expires on January 1, 2021, which means the Legislature will need to revisit the issue and hammer out a compromise bill before that date.
CCPA and B2B Communications
AB 1355 exempts communications and transactions between two individuals in their professional roles from CCPA compliance. The exemption applies to a natural person who is an employee, owner, director, officer, or contractor of a government agency or business. For example, the CCPA does not apply where a company representative communicates with a vendor representative.
The California Legislature is also kicking the can down the road on this topic. As with the employee amendment, the B2B modification expires on January 1, 2021.
Death To Toll-Free Numbers
The CCPA contains language requiring businesses to provide consumers both a toll-free number and email address where they can submit requests to exercise their rights. Many commentators, such as moi, felt this requirement was a bit out of touch with how businesses operate online. Most blogs, forums, and apps communicate with visitors via email – not phone calls – and do not have phone numbers or call centers.
The Legislature passed AB 1564, which addressed the telephone number topic. If a company operates solely online and has a direct relationship with a consumer, then it need only provide consumers with an email address. However, companies who also operate in the physical world, such as a store with retail outlets and a website, must provide both the toll-free number and email address.
Publicly Available Information
The California Legislature rushed the original CCPA into law for a variety of political and timing reasons. A side-effect of that process is poorly drafted legislation. AB 874 is an amendment designed to clarify one such drafting error by clearly defining what is considered “publicly available information” in relation to government records.
The amendment also contains two other provisions that are favorable to businesses. First, the amendment clarifies that only data that can “reasonably” be associated with a particular consumer shall fall within the personal information definition in the CCPA. The amendment also clarifies that personal information that is de-identified or aggregated data should not be considered personal data as defined in the CCPA.
CCPA Vehicle Warranty and Recall PI
The Legislature passed AB 1146 addressing auto manufacturer and dealer concerns regarding vehicle warranty and recall information. Auto manufacturers need to maintain such data to profile vehicles. AB 1146 allows for this and notes that consumers cannot opt-out of the sale of such information. Keep in mind, the CCPA defines the term “sale” extremely and could include the mere transfer of repair data from a dealer to an auto manufacturer.
Data Brokers Must Register
The Legislature also passed AB 1202 requiring data brokers to register with the California Attorney General. The “AG” must also create an online database of the brokers which the public can access.
Loyalty-Programs Amendment Rejected
In a bit of a surprise, the Legislature rejected one of the proposed CCPA final amendments addressing a common consumer plan. AB 846 would’ve have provided clarity on whether companies can offer loyalty programs to consumers without being considered to discriminate against those consumers who do not participate. I suspect the Legislature will revisit the topic once predatory consumer lawyers start filing lawsuits against companies claiming loyalty and rewards programs are discriminatory.
The CCPA final amendments now wait for the signature of Governor Newsom. Although the California Governor has shown an independent streak at times, I expect him to sign each of the amendments into law no later than October 13, 2019.
The California Consumer Privacy Act goes into effect on January 1, 2020. Companies large and small should be preparing for the new requirements now. Contact me for assistance.
Richard A. Chapo, Esq.