The Most Comprehensive Data Protection Solution
Discover, classify, and protect your data from all threats with the only Gartner Magic Quadrant DLP and Forrester Wave EDR Leader.
First and Only Solution to Converge:
- Data Loss Prevention
- Endpoint Detection and Response
- User and Entity Behavior Analytics
As the California Consumer Privacy Act (CCPA) continues to take shape, the state's Senate Committee on the Judiciary voted to advance seven amendments to the law last week but not after making some changes.
We’re nearly five months away from its go-live date but it's still unclear what exactly the California Consumer Privacy Act will look like. Seemingly every month there’s a new hurdle for lawmakers to overcome.
The latest, last week, saw seven amendments pass through the California Senate Committee on the Judiciary. While some were outright approved, others were amended and approved.
The legislature has until September 13, 2019 to pass any bills related to the CCPA, meaning the state's Senate has less than two months to deliberate the law's innerworkings. It's expected that California's Committee on Appropriations will vote on the following bills, among others next month, followed by a vote in the full Senate.
Here's a break-down of the #CCPA amendments that passed CA Senate Judiciary Cmtee last night - for those w/Tuesday night social lives. In order of bill#. Almost all passed - several w/amendments may need to be reconciled w/Assembly versions, one 3-3 tie, & one withdrawn. 1/x pic.twitter.com/y0e9x3wHGQ
— Stacey Gray (@staceygraydc) July 10, 2019
Among those amendments passed was Assembly Bill 874, which would tweak the law's language around publicly available information. Currently the CCPA defines publicly available information as data “used for a purpose that is not compatible with the purpose for which the data is maintained and made available in the government records or for which it is publicly maintained.” AB-874 would change that to include any data made available via federal, state, or local government records. AB-874 would also change how "personal information" is defined by excluding deidentified or aggregated consumer data.
Speaking of deidentified or aggregated consumer data, a clarifying amendment passed last week, Assembly Bill 1355, would also exempt the aforementioned from being defined as “personal information.” The intent of this bill was to revise drafting errors in the CCPA, so it's not entirely surprising to see it pass.
Five other amendments were passed but not before being modified by the Judiciary Committee.
One change, to Assembly Bill 25, would give employers an extra year to honor the tracking, responding to, and complying with employee requests for disclosure, copies, and deletion of employee personal information. While it may sound like employers are getting a break with this amendment, they will still have to disclose what personal information they collect and the business purposes for which its collected and used. It's believed that employee privacy will be a subject of increased legislation in 2020, after the CCPA goes into effect. AB-25 previously passed the California Assembly in May.
A change to Assembly Bill 846, largely known as the loyalty program bill, would mandate that businesses who collect data on consumers as part of either a loyalty, rewards, discount, or club card program can't sell the consumers' data. The bill's intent from the get go has been to prohibit customer loyalty programs, of which many Americans are a member, from the CCPA's anti-discrimination provision, as long as they’re not “unjust, unreasonable, coercive or usurious in nature.”
Yet another change to an amendment, Assembly Bill 1202, eliminated language that would have allowed consumes to opt out of the sale of their data by data brokers. Previously the bill would have required legislation would require data brokers to honor consumer opt-outs among other rights afforded by the CCPA. It still requires data brokers to register with the state's Attorney General and pay a registration fee.
Assembly Bill 1564, a bill that would require consumers to submit CCPA requests to businesses through either a toll-free number or an email address and a physical address, was tweaked as well. The Judiciary Committee approved the amendment after changing it to say that companies that operate online-only businesses are exempt from having a toll-free number.
The last amendment that was edited was a minor one, Assembly Bill 1146, which regards vehicle information. The amendment would exempt data that's gathered or retained for warranty or recall matters under CCPA. The bill was amended to stipulate that the data in question stems from a product recall conducted in accordance with federal law.