A new ballot initiative would create the California Privacy Rights and Enforcement Act (“CPREA”) and would make several changes to the California Consumer Privacy Act (“CCPA”).

CPREA makes the following changes and additions:

  • California Privacy Protection Agency: This ballot initiative would establish the California Privacy Protection Agency (“CPPA”), which would be comprised of five members appointed by members of the California government. The CPPA would be tasked with adopting rules, appointing a Chief Privacy Auditor who would proactively audit businesses for compliance, and bringing enforcement actions.
  • Additional Disclosures: CPREA would require that businesses tell consumers whether they profile them in certain circumstances (such as where profiling is reasonably expected to have an effect on financial loans or education admissions), together with the “logic involved” in using personal information for such profiling. Additionally, businesses that use personal information for political purposes would also be subject to specific disclosure obligations, including identification of the candidates, committees, or ballot measures for which personal information is used.
  • Amended Definition of Sale: Notably, the CPREA would define “sale” to include transfers of personal information not only for monetary or other valuable consideration, but also disclosures “otherwise for a commercial purpose, including but not limited to cross-context behavioral advertising.” This edit is similar to the broader “sale” definition proposed in the original ballot initiative, which did not require any consideration and was explicitly rejected by the California legislature. “Cross-context behavioral advertising” is defined as the “targeting of advertising to a consumer based on a profile of the consumer including predictions derived from the consumer’s personal information, where such profile is related to the consumer’s activity over time and across multiple businesses or across multiple, distinctly-branded websites, application, or services.” For consumers who opt-out of the sale of their personal information or opt-out of the use or disclosure of personal information for advertising and marketing, the ballot initiative would require businesses to wait for at least 12 months before requesting authorization to sell, or use and disclose, the consumer’s personal information.
  • Sensitive Personal Information: CPREA creates a new category of “sensitive personal information.” CPREA provides consumers with the right to opt-out of the use or disclosure of their sensitive personal information “for advertising and marketing,” which is defined to include communications intended to induce a consumer to buy, rent, lease, join, use, subscribe to, apply for, provide, or exchange products, goods, property, information, services, or employment. “Sensitive information” includes (for example) financial information, health information, race and religion, and precise geolocation information. Notably, sensitive information already is heavily regulated under other federal and state privacy laws.
  • Heightened Protection for Consumers under 16 years of age: Businesses would not be permitted to collect personal information of consumers less than 16 without opt-in consent if the business has actual knowledge that the consumer is less than 16.
  • Creates New Regulated Entities and Relationships: The CPREA introduces the role of a “contractor.” The ballot initiative would require that contractors be subject to contractual restrictions, including prohibitions on the sale of personal information, restrictions on retaining and using personal information, and certifications to the business.
  • Private Right of Action: As drafted, the private right of action is available for certain data breaches that result from unreasonable security practices and only if a business does not cure the “violation” within 30 days’ notice by a plaintiff. CPREA would expressly state that the implementation and maintenance of reasonable security procedures and practices following a breach would not constitute a cure that would serve as a defense to a claim.

The author of the ballot initiative intends to include this proposal on the November, 2020 ballot.

Print:
EmailTweetLikeLinkedIn
Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.

Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager helps national and multinational clients in a broad range of industries anticipate and effectively evaluate legal and reputational risks under federal and state data privacy and communications laws.

In addition to assisting clients engage strategically with the Federal Trade Commission, the…

Lindsey Tonsager helps national and multinational clients in a broad range of industries anticipate and effectively evaluate legal and reputational risks under federal and state data privacy and communications laws.

In addition to assisting clients engage strategically with the Federal Trade Commission, the U.S. Congress, and other federal and state regulators on a proactive basis, she has experience helping clients respond to informal investigations and enforcement actions, including by self-regulatory bodies such as the Digital Advertising Alliance and Children’s Advertising Review Unit.

Ms. Tonsager’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, behavioral advertising, e-mail marketing, artificial intelligence the processing of “big data” in the Internet of Things, spectrum policy, online accessibility, compulsory copyright licensing, telecommunications and new technologies.

Ms. Tonsager also conducts privacy and data security diligence in complex corporate transactions and negotiates agreements with third-party service providers to ensure that robust protections are in place to avoid unauthorized access, use, or disclosure of customer data and other types of confidential information. She regularly assists clients in developing clear privacy disclosures and policies―including website and mobile app disclosures, terms of use, and internal social media and privacy-by-design programs.

Photo of Kurt Wimmer Kurt Wimmer

Kurt Wimmer is a partner concentrating in privacy, data protection and technology law.  He advises national and multinational companies on privacy, data security and technology issues, particularly in connection with online and mobile media, targeted advertising, and monetization strategies.  Mr. Wimmer is rated…

Kurt Wimmer is a partner concentrating in privacy, data protection and technology law.  He advises national and multinational companies on privacy, data security and technology issues, particularly in connection with online and mobile media, targeted advertising, and monetization strategies.  Mr. Wimmer is rated in the first tier by Legal 500, designated as a national leader in Chambers USA, and is included in Best Lawyers in America in four categories.  He represents companies and associations on public policy matters before the FTC, FCC, Congress and state attorneys general, as well as in privacy assessments and policies, strategic content ventures, copyright protection and strategy, content liability advice, and international matters.

Photo of Jayne Ponder Jayne Ponder

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection…

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection counsel to companies, including on topics related to privacy policies and data practices, the California Consumer Privacy Act, and cyber and data security incident response and preparedness.