By Claudia James and Beth Inadomi
California’s New Model
While past legislative and regulatory efforts ran into intractable stakeholder interests from consumer groups and business, the California Consumer Privacy Act – signed into law on June 28, 2018 – may do what California legislation does often – serve as a catalyst for federal action. As the nation’s first sweeping privacy law, the Act provides to consumers several rights related to access, use and storage of their personal data including the right to know what personal information is being sold or disclosed; the right to delete personal data; and, the right to stop a business from selling their information. The law also prohibits companies from charging or treating customers differently if they opt out of having their data sold. In a victory for child privacy advocates, the law also restricts sharing and selling of data for consumers under the age of 16.
The California Consumer Privacy Act applies only to residents of the state, though the law has broad impacts. Online data is collected by companies across sectors. Further, many companies that deal with consumer data have business interests in California, the fifth largest global economy. It may be more cost-effective for companies doing business in California to choose to apply the state’s stricter privacy standards across borders rather than try to adhere to other individual state requirements that are less stringent.
The new California privacy law was remarkable in that it was introduced, considered and passed by both the Assembly and Senate and signed into law within a week. It was the focused compromise among legislators and stakeholders to head off a popular initiative that, if adopted by Californians this November, would have made subsequent changes onerous if not impossible. The Act’s effective date is January 1, 2020, ensuring that for the next several months California will be hashing out amendments to its new privacy law and serving as center stage for the implementation of a digital privacy framework in the United States. Privacy advocates, emboldened by success in the Golden State, are working to introduce bills and amend existing statutes in other jurisdictions to give consumers greater say over their personal data.
Federal Legislation and Preemption
The road to federal privacy legislation has been fraught with roadblocks and potholes. Legislative efforts began over 16 years ago but bills have stalled at various points along the way.
Like efforts to address data breaches, federal policymakers have grappled for years with what level of federal regulation to impose and whether to include preemption. Privacy advocates will press for the federal bill to be a floor, allowing states to go further. Industry will want preemption to agree to a federal statute and will differ with privacy proponents on the amount of federal regulation. This tension has contributed to the demise of previous privacy legislative efforts.
Concurrently, the Federal Trade Commission (FTC) is pursuing its own path. Starting this week, the FTC will embark on a series of hearings regarding competition and consumer protection in the 21st century and include consumer privacy issues. According to the FTC, the extensive review is driven by broad-based changes in the economy, new technologies, changing business practices and international developments. The review “may identify areas for enforcement and policy guidance, including improvements to the agency’s investigation and law enforcement processes, as well as areas that warrant additional study.”
What to Anticipate
Claudia James leads Cogent Strategies' technology, telecommunications, media and intellectual property practice. She has extensive working relationships with the judiciary and commerce committees in both the US Senate. Claudia was previously the vice president for government relations and associate general counsel at the American Newspaper Publishers Association. For Claudia’s complete bio, click here.
Beth Inadomi provides strategic and political guidance to Cogent Strategies' clients based in or doing business in California, as well as those clients who are interested in doing business in California. A recognized leader in technology policy, she offers expert counsel on issues related to clean technology, information technology, biotechnology and aerospace. She also serves as the firm's nexus in Sacramento. For Beth’s complete bio, click here.