The recent Exactis data leak, which could surpass Equifax in the sheer number and scope of records exposed, has data privacy advocates calling for an “American GDPR.” While it is unlikely that a federal data privacy law will come to pass anytime soon, some states have already taken matters into their own hands. The California Consumer Privacy Act (CCPA), which was coincidentally signed into law the day after the Exactis leak hit the news, is the latest example.
However, while the California Consumer Privacy Act codifies many rules that are beneficial to consumers, it also has significant shortcomings. It is the toughest data privacy law in the U.S., but calling it an “American GDPR” is more than a bit of a stretch.
The Pros of the California Consumer Privacy Act
First, let’s look at some of the new rights California consumers can look forward to:
* The right to know what information companies are collecting, what categories of data will be collected prior to collection, and why they are collecting it.
* The right to prohibit companies from selling their information.
* Minors under 16 must opt in before their data is collected at all.
* The right to know the categories of third parties with whom their data is being shared.
* The right to know the categories of sources of information from whom their data was acquired.
* The right to sue companies for violations of the CCPA.
Businesses can be fined up to $7,500 for each violation of the CCPA. While this may seem like a nominal amount, if hundreds, thousands, or even millions of records are involved, the penalties could be staggering.
The Drawbacks of the California Consumer Privacy Act
The CCPA has an interesting backstory. It began not as a bill, but a ballot initiative that was largely bankrolled by real estate developer Alistair Mactaggart. Mactaggart’s initiative — which had collected over 600,00 signatures and was on its way to being placed on the ballot in November — was stricter than the CCPA. Additionally, unlike state laws, which can be amended by the state legislature, once a California ballot initiative is passed by voters, it can be amended only by another successful ballot initiative. Lawmakers, pressured by tech companies who were spooked by the proposed referendum, hurriedly drew up and passed the CCPA as the deadline for the November ballot loomed. Mactaggart had promised to withdraw his initiative if the legislature passed a “comparable” law, and he made good on this promise.
Since the CCPA was rather hurriedly drafted, and was drafted for the specific purpose of avoiding a much stricter law that would have been incredibly difficult to amend, it contains numerous drawbacks, including:
* While the California Consumer Privacy Act gives consumers the right to know what information companies are collecting, it doesn’t require them to get permission before collecting it unless the data subject is under 16 years old.
* Companies also don’t have to give consumers the option of opting out of having their data collected.
* Similarly, while companies are required to inform consumers if they are selling or sharing their information, the requirement applies only if they are asked.
* Consumers have to wait for a company to actually sell their information before they can tell the company to stop.
* Consumers cannot opt out of having their information “shared,” only “sold.” They have the right to know the “categories” of who the data is being “shared” with, but they can’t stop it.
* Consumers don’t have to be informed exactly who their data is being sold to or “shared” with, only the “categories” of these companies.
* The CCPA applies only to residents of California, while they are in California. If a Californian shares their data while on a weekend trip to Las Vegas, the CCPA doesn’t apply.
Additionally, the California Consumer Privacy Act doesn’t come into effect until January 1, 2020, and tech companies are already pressuring the legislature to water it down further. This hasn’t escaped Alistair Mactaggart’s attention, as Bloomberg reports:
“There is the risk that tech will now sneakily come in and eviscerate this law,” Mactaggart says. “I want to stay involved to make sure we keep the gains we made.” He’s considering putting together a group of engineers and technical experts to help the state attorney general put the law into effect and enforce it. “The AG is going to have to produce some very sophisticated granular rules for how this stuff gets implemented, and [the tech industry] is going to be lobbying the AG six ways to Sunday,” he says.
Mactaggart also told Bloomberg that if the CCPA is weakened too significantly, he will consider another ballot initiative.
As the old saying goes, “California leads the nation.” Regardless of the ultimate fate of the CCPA, now that California has decided to address consumers’ increasing demands for data privacy and security, enterprises can expect similar legislation or even ballot initiatives in other states.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.