Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-5358" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2018/06/California-iStock_000035956244_Large-662x992.jpg" alt="" width="217" height="325" />

The public forums on the California Consumer Privacy Act (CCPA), held by the California Attorney General (AG) and the Department of Justice, continued on Friday, Jan. 25, in Los Angeles, California. At the forum, speakers had a brief opportunity to provide their comments on the CCPA. Prior to opening up the floor to members of the public for comments, representatives from the AG’s office articulated to the couple of hundred attendees that they are seeking public comment in the following areas in which the California AG has the authority to solicit public participation and issue regulations pursuant to Section 1798.185 of the CCPA:
<p style="padding-left: 30px">1. Categories of personal information.
2. Definition of unique identifiers.
3. Exceptions to the CCPA.
4. Submitting and complying with requests.
5. Uniform opt-out logo/button.
6. Notices and information to consumers, including financial incentive offerings.
7. Verification of consumer requests.</p>
Among the public comments they made at the forum, speakers urged the AG’s office to do the following as it promulgates CCPA regulations:
<ul>
 	<li>Provide clarification on the interaction between the CCPA and the Health Insurance Portability and Accountability Act, the Gramm-Leach-Bliley Act, the Children’s Online Privacy Protection Act, California’s Shine the Light law, and the Family Education Rights and Privacy Act.</li>
 	<li>Develop a uniform “Do Not Sell My Personal Information” logo modeled on the AdChoices icon for the “Do Not Sell My Personal Information” opt-out.</li>
 	<li>Provide clarification on the types of records businesses need to maintain to be able to demonstrate they have complied with the CCPA in the event there is an AG action.</li>
 	<li>Provide clarification on how a business can verify a consumer request if it has extremely limited information on a consumer, such as only a device identifier.</li>
 	<li>Clarify what is and is not a “sale” of personal information.</li>
</ul>
Consumer activists in attendance urged the AG’s office to join the European Union in expanding privacy rights of the public with the CCPA, while industry speakers urged practical solutions and clear guidance. The AG’s office did not respond to any speaker’s comments or questions. Although the forum was scheduled to last three hours, it ended about two hours in, when there were no further public comments. There will be three more opportunities to provide public comments on the CCPA: during public forums scheduled in Sacramento and Fresno in February, and in Stanford in March. Written comments can also be submitted to the AG’s office by email to <a href="mailto:privacyregulations@doj.ca.gov">privacyregulations@doj.ca.gov</a> or by mail to CA-DOJ, ATTN: Privacy Regulations Coordinator, 300 S. Spring St., Los Angeles, CA 90013. BakerHostetler will be filing written comments on behalf of our collective clients without reference to client names.  Contact the authors if you have comments you would like us to include.

The AG’s office stated that it anticipates beginning the official rulemaking process in the fall of 2019. The AG representatives indicated at the forum that they will look generally to the federal rulemaking process for guidance on how to solicit further comments in promulgating regulations, including holding public hearings and accepting written comments. While they did not commit to issuing a proposed rule for the public to comment on before the final rule is issued, doing so would be consistent with the federal rulemaking process. BakerHostetler will continue to follow the CCPA regulatory process and provide further updates as the process continues.

A summary of the CCPA is available <a href="https://www.dataprivacymonitor.com/wp-content/uploads/sites/5/2019/01/Overview-of-the-New-California-Consumer-Privacy-Law.pdf">here</a>, and a comparison to the General Data Protection Regulation is available <a href="https://www.dataprivacymonitor.com/wp-content/uploads/sites/5/2019/01/CCPA-vs-GDPR-comparison-chart.pdf">here</a>. You can find information on BakerHostetler’s CCPA compliance services <a href="https://www.dataprivacymonitor.com/wp-content/uploads/sites/5/2019/01/California-Consumer-Privacy-Act-Compliance.pdf">here</a>, or feel free to contact the authors. Information on the San Francisco CCPA forum attended by BakerHostetler is available <a href="https://www.dataprivacymonitor.com/ccpa/first-public-forum-on-the-california-consumer-privacy-act/">here</a>.

Public Forums on the California Consumer Privacy Act Continue in Los Angeles – Rulemaking to Follow