Summary of California Consumer Privacy Act of 2018

In 2018, the California Legislature enacted the California Consumer Privacy Act of 2018, Civil Code, § 1798.10 et seq., effective January 1, 2020.  The statute is the byzantine manifestation of an effort to thwart a much more severe ballot initiative that was withdrawn because of the enactment of the statute.

The statute seeks to protect the dissemination by sale and disclosure of information related to California residents (defined as consumers in the statute) and provides certain rights to consumers to control the use, sale and disclosure of that information.  At the same time, the statute imposes obligations upon businesses to disclose to consumers on request information regarding collection, use and sale of personal information.

Overall, the California Attorney General is responsible for enforcing the statute.  Complementing this public enforcement, the statute creates a private right of action in consumers authorizing them to sue businesses who have experienced a data breach by reason of a failure to implement and maintain reasonable security procedures and practices.

The statute is not well drafted; it is verbose and ambiguous.  On or before January 1, 2020, the Attorney General is required to adopt regulations to further the purposes of the statute.

Pending amendments to the statute appear intended to make the statute even more draconian than it currently is.

Certain terms used in this summary have been italicized to reflect that the terms have a formal definition in the statute itself.  The definitions are extensive and contained in section 1798.140 of the Civil Code.  When reading the actual language of the statute, one should have a copy of that section at hand.

What follows is an Executive Summary taken from the Legislative Counsel’s Digest of the CCPA.  For a more detailed summary, please read our white paper here.

EXECUTIVE SUMMARY OF THE CCPA

The Legislative Counsel’s Digest provides:

The California Constitution grants a right of privacy. Existing law provides for the confidentiality of personal information in various contexts and requires a business or person that suffers a breach of security of computerized data that includes personal information, as defined, to disclose that breach, as specified.

This bill would enact the California Consumer Privacy Act of 2018. Beginning January 1, 2020, the bill would grant a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of 3rd parties with which the information is shared.

The bill would require a business to make disclosures about the information and the purposes for which it is used.

The bill would grant a consumer the right to request deletion of personal information and would require the business to delete upon receipt of a verified request, as specified.

The bill would grant a consumer a right to request that a business that sells the consumer’s personal information, or discloses it for a business purpose, disclose the categories of information that it collects and categories of information and the identity of 3rd parties to which the information was sold or disclosed.

The bill would require a business to provide this information in response to a verifiable consumer request.

The bill would authorize a consumer to opt out of the sale of personal information by a business and would prohibit the business from discriminating against the consumer for exercising this right, including by charging the consumer who opts out a different price or providing the consumer a different quality of goods or services, except if the difference is reasonably related to value provided by the consumer’s data.

The bill would authorize businesses to offer financial incentives for collection of personal information.

The bill would prohibit a business from selling the personal information of a consumer under 16 years of age, unless affirmatively authorized, as specified, to be referred to as the right to opt in. The bill would prescribe requirements for receiving, processing, and satisfying these requests from consumers.

The bill would prescribe various definitions for its purposes and would define personal information with reference to a broad list of characteristics and behaviors, personal and commercial, as well as inferences drawn from this information.

The bill would prohibit the provisions described above from restricting the ability of the business to comply with federal, state, or local laws, among other things.

The bill would provide for its enforcement by the Attorney General, as specified, and would provide a private right of action in connection with certain unauthorized access and exfiltration, theft, or disclosure of a consumer’s nonencrypted or nonredacted personal information, as defined.

The bill would prescribe a method for distribution of proceeds of Attorney General actions.

The bill would create the Consumer Privacy Fund in the General Fund with the moneys in the fund, upon appropriation by the Legislature, to be applied to support the purposes of the bill and its enforcement.

The bill would provide for the deposit of penalty money into the fund.

The bill would require the Attorney General to solicit public participation for the purpose of adopting regulations, as specified.

The bill would authorize a business, service provider, or 3rd party to seek the Attorney General’s opinion on how to comply with its provisions.

The bill would void a waiver of a consumer’s rights under its provisions.