SACRAMENTO -- April 10, 2019 -- The California Senate Standing Committee on Judiciary yesterday voted 5-3 in support of SB 561 which would expand the private right of action under the California Consumer Protection Act (CCPA) beyond damages for data breaches. The bill would also remove the 30-day cure period for Attorney General enforcement actions and remove the AG’s obligation to provide compliance opinions. The bill now moves to the Senate Standing Committee on Appropriations.
The hearing on SB 561 lasted for several hours yesterday during which the committee heard statements for and against the changes, then turned to a sometimes contentious debate. Among other things, the AG’s office shared thoughts on how to clarify the term “cure” in the statute and senators’ suggested that other law enforcement agencies might help with enforcement in lieu of a private right of action.
For additional background, see our recent post: Consumer Privacy Act Getting New Teeth as 2020 Approaches.
Those in Favor
In her opening remarks, Committee Chair Senator Hannah-Beth Jackson said the AG’s proposed amendments would make CCPA enforceable, otherwise it’s doomed to become a “right without a remedy.” Sen. Jackson argued that the amendment affords consumers access to justice by allowing them to exercise their OWN rights under the CCPA, which as currently written only extends to data breaches and not other violations of the act. This expanded enforcement mechanism, she argued, ensures accountability by removing the right-to-cure provision that hinders the AG’s enforcement. She also noted that the bill does not implicate the right-to-cure provision attached to the consumer enforcement provision; it only removes that provision for the AG. Likewise, Sen. Jackson said requiring the AG to provide opinions would be burdensome and a drag on taxpayer funds.
According to Sen. Jackson, opponents of the amendment want to dilute CCPA’s impact and cater to their specific interests, for example, by seeking exemptions for certain industries. Arguments that increased privacy enforcement will stifle innovation are tiresome, said Sen. Jackson, and are contradicted by industry requests for more privacy regulation, a reference Facebook. Profit, she argued, cannot come at expense of values and priorities of people the legislators represent, and if privacy is incompatible with a company’s business model, it is time to innovate. In fact, she said, companies that promise privacy are flourishing.
A representative of the AG’s office noted that the CCPA offers protection for consumers but also presents serious workability challenges for the AG’s office. It is too difficult, he said, for the AG to carry out enforcement duties under CCPA as written.
Mike Maddock, counsel for Consumer Watchdog, also made statements in favor of the consumer’s right to seek damages for an unauthorized breach where there have not been reasonable efforts by the business and elimination of the 30-day cure provision.
Nancy Drabble, CEO of Consumer Attorneys of California, spoke in support of SB 561 to strengthen privacy legislation and stressed that consumers’ ability to enforce their own privacy rights is imperative.
The California Consumer Coalition, Electronic Frontier Foundation, ACLU and Privacy Rights Clearinghouse also sent representatives to speak in support of strengthening the act through private enforcement.
Kevin Baker, legislative director of the ACLU, noted that his organization has conducted statewide polling on the issue and found that 94% of Californians support the private right of action posed by SB 561.
Finally, a representative from Consumer Reports stated that they were initially reluctant to support CCPA due to weak enforcement provisions, and support strengthening those provisions through this amendment.
Those Opposed
An attorney from the California Chamber of Commerce, or CalChamber, was first to make statements in opposition, arguing that:
• CCPA will be challenging to implement for the AG and for businesses.
• Because the law is a “moving target” and regulations won’t be finished until after enforcement starts, businesses will not have reasonable time to comply. First, she said, clarifications are needed to avoid unintended consequences. She did not elaborate on those consequences.
• The proposed amendment rolls back the most critical agreements leading to the passage of the CCPA, which was that the law would be enforced by the state.
• If SB 561 is passed, trial attorneys will profit by testing business's ability to comply with a challenging law that can be vague and ambiguous.
• Even experts disagree on some parts of the law; this is a significant and unfair burden for business.
• This law is not just about large companies, smaller businesses such as cafes and pizzerias may have to comply under the current thresholds.
• There is already an aggressive private right of action for data and security breaches.
• Rolling back right to seek guidance and cure is also not fair to business.
• GDPR is focused on compliance and CCPA should be as well.
A private practice attorney also offered remarks, raising these points:
• Businesses want to comply, but there are challenges that legislators may not have intended and now expose them to class actions.
• The CCPA includes entire households in the definition of personal information, but Californians increasingly live in co-living arrangements due to our housing crisis. So, if a consumer requests information under the law, should the business disclose the whole household’s information?
• What about domestic abusers requesting access to the household’s internet searches? Must those requests be granted?
• California should follow the EU’s lead and focus on compliance and a culture of collaboration as businesses attempt to legitimately comply with the regulations.
Numerous other entities then took turns stating their opposition, including: the Entertainment Software Association, the Securities Industry Association, the California Car Dealers Association, the Civil Justice Association, the National Payroll Reporting Consortium, TechNet, the Advanced Medical Tech Association, the Consumer Tech Association, the Toy Association, the California Retailer’s Association, the Computing Tech Association, the California Hospital Association, the Internet Association, SDG&E, California News Publishers, Interactive Advertising Bureau, the California Bankers Association, the Consumer Data Industry Association, the California Restaurant Association, CTIA, the Wireless Industry Association of Advertisers, the Mortgage and Bankers Association, the California Communications Association, and the Nonprofit Alliance.
Debate and New Proposals
The Right to Cure
In the debate following the opening statements, one senator pointed out that the term “cure” is not defined in the statute, leaving as an open question the standard to be met to achieve a cure. Sen. Jackson responded that the proposed amendment takes away the right to cure because it does create challenges: the AG cannot be tasked with providing legal advice and an opportunity to cure, and then be expected to sue the businesses it has advised. Sen. Jackson agreed there will be too much confusion about the right to cure and the standard for adequate compliance. But this is not the wild west, Sen. Jackson argued, and the AG has held hearings statewide to give guidance.
The AG’s office pointed out that the right to cure regarding AG enforcement differs from the private right of action right to cure, which will not be removed by the proposed amendment. But there are other statutory provisions with a similar right to cure that the AG’s office has looked to for guidance, for example: (i) the Shine the Light Law; (ii) SB 782, which defines a cure as an appropriate correction or other remedy; and (iii) the Labor Code, which takes a procedural approach by creating greater due process around this procedure.
Finally, Sen. Jackson suggested that upcoming rulemaking can clarify the definition of the term “cure.” Other senators were skeptical that regulations can resolve these issues, warning that courts may be left to resolve it instead.
Alternatives to private right of action
One senator suggested there might be another mechanism for enforcement, similar to that in the CA Bus. Prof. Code 17200, under which a public official is authorized to enforce the law. If something similar was incorporated in the CCPA, he argued, the individual private right of action could be removed, and a city, county, or district attorney would be entitled to enforce in lieu of private plaintiffs. Sen. Jackson said she has discussed this possibility with the AG’s office, which indicated they are willing to pursue this as an avenue.
Other debate
Sen. Anna M. Caballero noted that she has spoken with Attorney General Javier Becerra to express concern about the CCPA’s effect on small businesses and startups. She wants to avoid indecision and confusion about privacy law in California and how it will be implemented, noting that any time the legislature creates a new area of the law it creates uncertainty. In the business community, she said, this sometimes means taking the most conservative approach and leaving the state altogether. The CCPA also applies to businesses outside of California, however.
Sen. Bill Monning addressed the argument that the current scope of private right of action under the CCPA was a key point of negotiation prior to passage, which was introduced to avoid a ballot measure in the November 2018 election. Opponents argue that legislators cannot change the terms of their deal, and Sen. Monning acknowledged that this is one of the downsides of using a legislative option to avoid taking the issue to the voters. But he also noted that the benefit of this approach is that legislators need not go back to ballot to fix something that is very complex. This process is “messy,” he conceded, but better than going back to the ballot. And now, the AG’s office is saying they are tasked with a job for which they do not have the resources. The AG’s office responded that they are seeking approval for 23 new positions to assist with CCPA enforcement. Senators complained that due to the 11th-hour nature of the CCPA’s passage, the AG’s office requested permission to weigh in but was not permitted to do so at that time.
Some senators disagreed with Sen. Monning, pointing out that they were only able to reach a deal to pass CCPA by stripping the private right of action. Rescinding that agreement, they argued, will compromise the legislators’ integrity. Others responded that industry stakeholders are doing just that: they are currently trying to introduce between 18 and 35 bills that would change the terms of the same agreement.
Without a private right of enforcement, a senator said, compliance efforts will be lax because businesses’ risk analysis will determine that the risk of enforcement is minimal. Another asked why the private right of enforcement for data breaches is not sufficient. Sen. Jackson offered an example in which a business has not complied with a consumer’s opt-out request, but there has been no data breach.
The Vote
The hearing concluded with a vote on whether to advance the bill out of the Standing Judiciary Committee and send it to the Standing Appropriations Committee. The vote passed with five yays and three nays, but with several senators saying they support advancing the bill they are not in support of the proposed measure its “current state.”