Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="size-medium wp-image-5358 alignright" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2018/06/California-iStock_000035956244_Large-200x300.jpg" alt="" width="200" height="300" />

On Thursday, June 22, 2018, a previously dead California Assembly bill, AB 375, was revised as a proposed alternative to the ballot initiative known as the California Consumer Privacy Act of 2018 (CCPA),[1] which is expected to be on the November ballot. It was read a third time and amended on June 25 and re-referred to the Senate Judiciary Committee. If the bill is passed and signed into law by June 28, 2018 – the deadline for finalizing what will be on the ballot – ballot initiative supporters have reportedly agreed to pull the ballot initiative. Below is a summary of key similarities and differences between AB 375 and the CCPA. If AB 375 is passed and signed by the governor this week in time for the CCPA to be withdrawn and we confirm it is withdrawn, we will provide greater detail on what AB 375 will require. The full text of the ballot initiative is <a href="https://oag.ca.gov/system/files/initiatives/pdfs/17-0039%20%28Consumer%20Privacy%20V2%29.pdf">here</a>, and the full text of AB 375 is <a href="https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375">here</a>.

The legislative approach in AB 375 will result in regulation of more for-profit entities than the ballot initiative would, as an entity with annual gross revenue in excess of $25 million is considered a “business” under the legislative approach, whereas under the ballot initiative, an entity is considered a business if it has annual gross revenue in excess of $50 million. Further, the definition of business is broader in the legislative approach in that it also applies to businesses that annually “sell” (broadly defined) personal information of “100,000 or more consumers or devices,” as provided by the CCPA, to include a business that “buys, receives for the business’ commercial purposes, sells, or shares for commercial purposes [broadly defined] … personal information of 50,000 or more consumers, devices, or households.” In addition to the different threshold number of data subjects, a key distinction is that AB 375 explicitly covers the recipients of personal information from a third party, while the CCPA addresses only a business “that collects consumer’s personal information.”



Further, under the legislative approach there are four carve-outs as to what constitutes a “sale,” whereas under the ballot initiative there are only two. Both exclude transfers at the direction of the consumer and to establish an identifier used to honor the opt-out. AB 375 adds transfers to service providers to perform services that are disclosed pursuant to the act’s privacy notice requirements and as part of a merger, acquisition, bankruptcy or change of control, subject to consistent usage requirements.

Consumers’ rights under both the ballot initiative and the legislative approach include the right to request that a business provide disclosures about the personal information collected about the consumer, the right to request information about the sale or disclosure of the consumer’s personal information, and the right to opt out of the business’ sale of the consumer’s personal information. The information requirements under AB 375 are somewhat more specific and detailed than those under the CCPA, with the notable exception that, as of the June 25 amendments, the specific identity and contact information of recipients of personal information need not be disclosed, just the categories of such parties. However, the opt-out under AB 375 is more narrow than under the CCPA, since the definition of sale under AB 375 requires a transfer for “monetary or other valuable consideration,” but the CCPA opt-out includes transfer where the recipient’s use is for their own commercial purposes, “whether for valuable consideration, or no consideration.” In addition, the legislative approach under AB 375 provides consumers the following additional rights: the right to request that the business delete any personal information the business has collected about the consumer (subject to numerous exceptions) and, for consumers who are younger than 16 years old, a requirement that the sale of that consumer’s personal information be only on an express opt-in basis. There are differences between how each proposal defines “personal information,” with the legislative approach requiring the data to be capable of association, directly or indirectly, with “a particular consumer or household” and CCPA tied to “a particular consumer or device.”

Under both approaches, there are restrictions on discriminating against a consumer based on that consumer’s exercising his or her rights by denying that consumer goods or services, charging that consumer different prices or rates, or providing that consumer a different quality or level of goods or services. However, unlike the ballot initiative, the legislative approach provides carve-outs in which the business can charge consumers different prices or rates or provide consumers a different level or quality of goods or services if that difference is reasonably related to the value provided to the consumer for the use of the consumer’s data. Further, under the legislative approach, a business may offer financial incentives to consumers if such incentives meet specific criteria, such as notice to consumers.

The remedies provided under the ballot initiative include consumer actions for statutory damages, class actions, civil actions by public entities such as the California Attorney General and local prosecutors and civil actions by whistleblowers.  Further, consumer harm is presumed by any violation of the act. The legislative approach would provide for its enforcement only by the Attorney General, except for a private action for consumers in connection with specified security breaches if specific criteria are met, such as the Attorney General’s refraining from acting within 30 days of notification of a consumer’s intent to bring an action. Further, under AB 375, a business will have a 30-day opportunity to cure any alleged violation after notice by the Attorney General of noncompliance. AB 375, as amended on June 25, would also preclude private actions under other laws, that provide a cause of action for unlawful conduct, such as California Business and Professions Code Section 17200, based on a violation of AB 375. Thus, one of the most significant differences between the two approaches is the substantial limitation by AB 375 of private lawsuits, including class actions.

Both the ballot initiative and the legislative approach provide that in the event of a conflict with other law, “the provisions of the law that afford the greatest protection for the right of privacy for consumers shall control,” with certain exceptions such as conflicts with the federal Health Information Portability and Accountability Act and the Fair Credit Reporting Act. AB 375 adds the federal Gramm-Leach-Bliley Act and the Driver’s Privacy Protection Act.

AB 375 will be effective only if the CCPA is timely withdrawn; otherwise, it will take effect on Jan. 1, 2020. The ballot initiative would go into effect sooner. By its terms, that would be the day following the election, but it would apply only to personal information collected nine months thereafter (Aug. 7, 2019). However, California Prop 71 on the June 2018 ballot passed, changing effective dates of ballot initiatives to five days after the California Secretary of State certifies the vote, which must occur within 43 days of the election. Thus the dates may get pushed out by as much as six weeks.

We will monitor and report on the legislative progress this week. If AB 375 is not enacted before Thursday, we will have to wait and see how California voters respond to the ballot initiative in November.

[1] AB 375 would also be called the California Consumer Privacy Act of 2018. However, in this memo, our use of that term, or CCPA, refers to the ballot initiative.

California Legislative Effort to Avert Privacy Ballot Initiative a Race Against the Clock