California just passed a new restrictive privacy law, the California Consumer Privacy Act of 2018.
Assuming the law is not amended before it comes into force on January 1, 2020, the California Consumer Privacy Act would require that:
- Consumers have the ability to request a record of what types of data an organization holds about them, plus information about what’s being done with their data in terms of both business use and third-party sharing.
- Businesses will have to have a verification process so consumers can prove they are who they say they are when they do their requesting.
- Consumers have a full right to erasure, with carve-outs for completion of a transaction, research, free speech, and some internal analytical use.
- Organizations will have to disclose to whom they sell data, and consumers will have the ability to object to the sale of their data. Businesses will have to put a special “Do Not Sell My Personal Information” button on their websites to make it easy for consumers to object.
- Sale of children’s data will require express opt-in, either by the child, if between ages 13 and 16, or by the parent if younger than that.
- Organizations cannot “discriminate against a consumer” based on the exercising of any of the rights granted in the bill. For example, you can’t provide a different level or quality of service based on a consumer objecting to the sale of their data. However, organizations could offer higher tiers of service or product in exchange for more data as long as they’re not “unjust” or “usurious.”
A covered “business” is defined as any for-profit entity that either does $24 million in annual revenue; holds the personal data of 50,000 people, households, or devices; or does at least half of its revenue in the sale of personal data.
The law would be enforced by the Attorney General and create a private right of action for unauthorized access to a consumer’s “nonencrypted or nonredacted personal information.” Failure to address an alleged violation within 30 days could lead to a $7,500 fine per violation (which could be per record in the database, for example).
The law protects any “consumer,” defined as a “natural person who is a California resident,” which is defined as “(1) every individual who is in the State for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the State who is outside the State for a temporary or transitory purpose.”
Takeaway: Concern for privacy is at an all-time high in the aftermath of the Cambridge Analytica scandal and as usual California is the first State to act. It will probably start other states enacting similar laws about consumers’ privacy rights.
