The Most Comprehensive Data Protection Solution

Discover, classify, and protect your data from all threats with the only Gartner Magic Quadrant DLP and Forrester Wave EDR Leader.

First and Only Solution to Converge:

  • Data Loss Prevention
  • Endpoint Detection and Response
  • User and Entity Behavior Analytics
DATAINSIDER

Digital Guardian's Blog

Seven CCPA Amendments Advance

by Chris Brook on Wednesday July 17, 2019

Contact Us
Free Demo
Chat

As the California Consumer Privacy Act (CCPA) continues to take shape, the state's Senate Committee on the Judiciary voted to advance seven amendments to the law last week but not after making some changes.

We’re nearly five months away from its go-live date but it's still unclear what exactly the California Consumer Privacy Act will look like. Seemingly every month there’s a new hurdle for lawmakers to overcome.

The latest, last week, saw seven amendments pass through the California Senate Committee on the Judiciary. While some were outright approved, others were amended and approved.

The legislature has until September 13, 2019 to pass any bills related to the CCPA, meaning the state's Senate has less than two months to deliberate the law's innerworkings. It's expected that California's Committee on Appropriations will vote on the following bills, among others next month, followed by a vote in the full Senate.

Among those amendments passed was Assembly Bill 874, which would tweak the law's language around publicly available information. Currently the CCPA defines publicly available information as data “used for a purpose that is not compatible with the purpose for which the data is maintained and made available in the government records or for which it is publicly maintained.” AB-874 would change that to include any data made available via federal, state, or local government records. AB-874 would also change how "personal information" is defined by excluding deidentified or aggregated consumer data.

Speaking of deidentified or aggregated consumer data, a clarifying amendment passed last week, Assembly Bill 1355, would also exempt the aforementioned from being defined as “personal information.” The intent of this bill was to revise drafting errors in the CCPA, so it's not entirely surprising to see it pass.

Five other amendments were passed but not before being modified by the Judiciary Committee.

One change, to Assembly Bill 25, would give employers an extra year to honor the tracking, responding to, and complying with employee requests for disclosure, copies, and deletion of employee personal information. While it may sound like employers are getting a break with this amendment, they will still have to disclose what personal information they collect and the business purposes for which its collected and used. It's believed that employee privacy will be a subject of increased legislation in 2020, after the CCPA goes into effect. AB-25 previously passed the California Assembly in May.

A change to Assembly Bill 846, largely known as the loyalty program bill, would mandate that businesses who collect data on consumers as part of either a loyalty, rewards, discount, or club card program can't sell the consumers' data. The bill's intent from the get go has been to prohibit customer loyalty programs, of which many Americans are a member, from the CCPA's anti-discrimination provision, as long as they’re not “unjust, unreasonable, coercive or usurious in nature.”

Yet another change to an amendment, Assembly Bill 1202, eliminated language that would have allowed consumes to opt out of the sale of their data by data brokers. Previously the bill would have required legislation would require data brokers to honor consumer opt-outs among other rights afforded by the CCPA. It still requires data brokers to register with the state's Attorney General and pay a registration fee.

Assembly Bill 1564, a bill that would require consumers to submit CCPA requests to businesses through either a toll-free number or an email address and a physical address, was tweaked as well. The Judiciary Committee approved the amendment after changing it to say that companies that operate online-only businesses are exempt from having a toll-free number.

The last amendment that was edited was a minor one, Assembly Bill 1146, which regards vehicle information. The amendment would exempt data that's gathered or retained for warranty or recall matters under CCPA. The bill was amended to stipulate that the data in question stems from a product recall conducted in accordance with federal law.

Tags: Privacy, Government

Recommended Resources


  • The seven trends that have made DLP hot again
  • How to determine the right approach for your organization
  • Making the business case to executives
  • Why Data Classification is Foundational
  • How to Classify Your Data
  • Selling Data Classification to the Business

Chris Brook

Chris Brook is the editor of Data Insider. He is a technology journalist with a decade of experience writing about information security, hackers, and privacy. Chris has attended many infosec conferences and has interviewed hackers and security researchers. Prior to joining Digital Guardian he helped launch Threatpost, an independent news site which is a leading source of information about IT and business security for hundreds of thousands of professionals worldwide.