CLA Legislative Day: CaCPA Is a Top Issue for Sacramento Judiciary Committees

sen jud legis

At the California Lawyers Association’s debut Legislative Day, members were able to meet with (i) Senator Hannah-Beth Jackson, Chair, Senate Judiciary Committee; (ii) Senator Andreas Borgeas, Vice-Chair, Senate Judiciary Committee; (iii) Assembly Member Mark Stone, Chair, Assembly Judiciary Committee; (iv) Assembly Member Ash Kalra, Member, Assembly Judiciary Committee; (v) Che Salinas, Chief Deputy Legislative Affairs Secretary for Operations, Governor’s Office and (vi) Cory Jasperson, Director of Governmental Affairs, Judicial Council of California.  It was clear from the discussions with each of the members that privacy and, in particular, the California Consumer Privacy Act (CaCPA) was going to be on the top of their list of legislative priorities.

Hats off to CLA leadership and Saul Bercovitch, CLA Director of Governmental Affairs in organizing this event.

CaCPA

SOJ 2018_SEN_8103.jpg

Sen. Jackson (right) with Chief Justice Cantil-Sakauye

Senator Jackson referenced her work on gender equality issues before touting her legislation (backed by Attorney General Xavier Becerra) to add a private right of action to CaCPA and the need to reign in companies such as Facebook.  I expressed concern about the private right action (i) since there is still uncertainty as to the scope of the legislation (see ILC Joins Privacy Professionals Calling for Changes to CalCPA); and (ii) my belief that litigation mills will use the statute to target, not the tech giants, but small-to-medium sized California companies (especially if there were no thresholds for materiality or actual damages).  Jackson believed that CaCPA’s language limiting the reach of the law to companies with gross revenue in excess of $25 million would protect such entities.

This ignores the other elements of the statute’s definitions under which CaCPA also would apply to any business that “purchases, receives, sells or shares the personal information of 50,000 or more “consumer, households or devices”.  As Santa Clara Law Professor Eric Goldman noted in his recent letter to the legislature (which the Internet Law Center joined):

The definition of “business” likely reaches many small businesses, including low-margin retail businesses that store 137 unique credit cards a day and tiny ad-supported websites/blogs that get only 137 unique visitors per day. 

Senator Jackson invited me to share my concerns with her staff.  This legislation is certain to pass, the only if is to what extent can the law be clarified or the scope of the private right of action narrowed.

Fitbit/Facebook Data Sharing

Senator Jackson was especially incensed over practices such as Fitbit sharing information on user’s menstrual cycles to companies like Facebook so they can be targetted with ads for baby products and, even worse, anti-vaccination misinformation. Fitbit’s current privacy policy provides

You may direct us to disclose your information to others, such as when you use our community features like the forums, 7-day leaderboard, and other social tools. For certain information, we provide you with privacy preferences in account settings and other tools to control how your information is visible to other users of the Services. Just remember that if you choose to participate in a challenge, information like your profile photo, posted messages, total steps in the challenge, personal statistics, and achievements, is not governed by your privacy preferences and will be visible to all other challenge participants.

You may also authorize us to share your information with others, for example, with a third-party application when you give it access to your account, or with your employer when you choose to participate in an employee wellness program. Remember that their use of your information will be governed by their privacy policies and terms. You can revoke your consent to share with third-party applications or employee wellness programs using your account settings.

CaCPA would require a more clearly defined privacy policy that explains “the categories of personal information to be collected and the purposes for which the categories of personal information shall be used” (with any additional uses requiring notice to the consumer) and lists the categories of personal information it has collected, sold or disclosed.

What About the “Data Dividend”

In his State of the State address, Governor Newsom stated

California’s consumers should also be able to share in the wealth that is created from their data. And so I’ve asked my team to develop a proposal for a new Data Dividend for Californians, because we recognize that your data has value, and it belongs to you.

Che Salinas from Governor Newsom’s Office explained that they were working on the details on this “Data Dividend” concept.

Senator Andreas Borgeas

Of the group, Senator Andreas Borgeas from Fresno was the lone Freshman and Republican legislator.  He recognized that CaCPA will be a big issue.  He presented himself as a pragmatic traditional small government conservative.

On an amusing note, addressing the Central Valley’s concerns over water issues, he quoted a saying that “whiskey is for drinking and water is for fighting.”