The California Consumer Privacy Act is almost here! The groundbreaking law takes effect January 1, 2020. Covered businesses and their service providers have already started preparing, as the CCPA continues to evolve since it was introduced. California’s legislative session ended on September 13th, with some final modifications to bills that would amend certain aspects of the CCPA. Unanimously approved in final form, they now move on to California Governor Gavin Newsom for consideration and final action on the CCPA.
As we’ve reported periodically over the course of the year, businesses and stakeholders have been clamoring to shape the CCPA in a number of ways. In late April, the California Assembly of Privacy and Consumer Protection Committee (“Committee”) introduced several bills addressing a number of issues with the law, such as excluding certain categories of information from personal information or from certain requirements under the law, and clarifying ambiguities. Some survived, and some did not.
Below is a rundown of key substantive amendments:
- AB 25 (Employee Personal Information Exemption): As we’ve previously reported, AB 25 went through several modifications over the course of the year. In its latest form, employee personal information would be excluded from many of the CCPA’s requirements (including the requirements that permit consumers to request: the deletion of their personal information; the categories of personal information collected; the sources from which personal information is collected; the purpose for collecting or selling personal information; and the categories of third parties with whom the business shares their personal information). But, employees of businesses subject to the CCPA still would be entitled to a privacy notice and able to commence a private right of action in the event affected by a data breach caused by a failure of the duty to maintain reasonable safeguards. Under the privacy notice provision, covered businesses would be required to inform consumers (including employees) as to the categories of personal information they collect and the purposes for which such personal information shall be used. Under the private right of action provision, employees of covered businesses would be permitted to bring an action, including as a class action, in the event their nonencrypted or nonredacted personal information is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures. Note: These changes concerning employee personal information are set to sunset on January 1, 2021, on the understanding that during this one-year period, the Legislature would consider more comprehensive employee privacy legislation.
- AB 874 (Publicly Available Information Exception): AB 874 removes a limitation on the “publicly available information” exception to the definition of personal information. If signed into law, publicly available information will be defined as “information that is lawfully made available from federal, state, or local government”. The bill removes the limitation stating that information is not publicly available if it is used for a purpose not compatible with the purpose for which the data is maintained and made available in the government records or for which it is publicly maintained.
- AB 1355 (Technical Corrections): AB 1355 made a number of noteworthy technical corrections and other changes:
- Relief for certain “business-to-business” (B2B) communication or transactions. Many businesses have been concerned about how to handle the personal information of business contacts. That is, the personal information about individuals who are not acting as “consumers” in the general sense, but engaging with the business to carry out transactions. AB 1355 would provide relief from certain CCPA requirements such as providing notice and granting access and deletion rights for the following personal information:
“Personal information reflecting a written or verbal communication or a transaction between the business and the consumer, where the consumer is a natural person who is acting as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency and whose communications or transaction with the business occur solely within the context of the business conducting due diligence regarding, or providing or receiving a product or service to or from such company, partnership, sole proprietorship, nonprofit or government agency.”
Note, similar to the temporary treatment of employee personal information in AB 25, this relief also is temporary – it lasts until January 1, 2021.
-
- Definition of “personal information.” Part of what makes the CCPA so expansive is its definition of personal information. That definition would cover information that is “capable of being associated with” a particular consumer or household. In an attempt to narrow the reach of personal information, AB 1355 inserts “reasonably” before “capable.” In addition, AB 1355 clarifies that personal information does not include deidentified or aggregate consumer information.
- Clarification of Fair Credit Reporting Act (FCRA) Exception. AB 1355 makes clear that the FCRA exception applies to activity that is authorized by the FCRA and is not limited solely to the sale of personal information from a consumer report. The exception applies to FCRA authorized “activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer’s credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency.”
- AB 1146 (Vehicle Information Exemption): AB 1146 exempts from a consumer’s right to opt out, vehicle or ownership information retained or shared between a motor vehicle dealer and the vehicle’s manufacturer, in anticipation of a vehicle repair covered by warranty or recall. It also exempts from a consumer’s right to request deletion, personal information necessary for a business to maintain to fulfill terms of a vehicle warranty or recall.
- AB 1564 (Consumer Requests for Disclosure Methods): AB 1564 provides alternatives to the current requirement that covered businesses make available to consumers a toll-free number to submit requests for information regarding the use of their personal information. If a business operates exclusively online, it may, in lieu of a toll-free number, provide an email address for submitting requests. This bill was recently narrowed limiting the exception to online businesses that have a direct relationship with California residents from which it collects personal information. Moreover, if an online business maintains a website, the business must provide the consumer with a submission request method via the website.
It also is worth noting that one important bill, AB 846, was removed on September 12th from consideration, with plans to be reintroduced next year. AB 846 addressed loyalty reward, discount and similar programs, including prohibitions on the sale of personal information collected as part of those programs, and a limited exception to that prohibition.
It is expected Governor Newsom will sign the Legislature-approved bills into law. Organizations should be doing their best to determine if they have CCPA obligations either directly as a business, because they control or are controlled by a business, or because they have contractual obligations flowing from a business. Efforts toward compliance need to begin now as the CCPA becomes effective January 1, 2020.