As previously detailed, the California Consumer Privacy Act of 2018 was hastily passed by the California legislature as a compromise designed to avoid a more far-reaching ballot initiative. Recognizing the need to clarify various drafting errors, the drafters are currently working on Senate Bill 1121, intended to clarify certain provisions of the Act and to make other technical corrections.
Advocates for the business community have seized on this opportunity to push for more significant changes to the Act. In a letter to the bill’s sponsor, Senator Bill Dodd, dated August 6, 2018, dozens of business groups from the advertising, technology, retail, health, and banking sectors recommend substantive changes to the Act that go well beyond the “technical” corrections phase contemplated by the Senate Bill 1121.
The changes advocated by the industry groups include: (1) delaying implementation of the Act (currently set for January 1, 2020) until 12 months after the Attorney General’s office completes its rulemaking process; (2) narrowing the definition of “personal information” to exclude de-identified and aggregate consumer information and to align with the notion of that is reasonably linkable to a particular person; and (3) clarifying the definition of a “consumer” subject to the Act to exclude employees of a business and those involved in business-to-business transactions. Consumer advocacy groups have pushed back in a response letter dated August 13, arguing that the proposals from the industry groups would fundamentally weaken the protections of the Act.
While changes to the Act are inevitable, the most interesting battle will likely occur over the definition of “personal information” and whether the legislature will heed the call from the technology advertising sector to exclude data used for ad targeting, such as cookies, IP addresses and web tracking information.