Countdown to CCPA – California Legislature Considers Amendments to the CCPA

Following the end of its summer recess, the California legislature is considering a number of potentially crucial amendments to the ground breaking California Consumer Privacy Act (“CCPA” or the “Law”). Over the next few weeks, California legislators will take up several CCPA amendments and will have until September 13, 2019 to conclude action on the various bills. September 13 is the last opportunity for the California legislature to amend the CCPA in 2019. The California Governor will then have until October 13, 2019 to sign or veto any bills passed by the California legislature. This article provides a brief overview of major amendments recently considered by the California Senate and how they might amend the CCPA.

What is the CCPA again?

The CCPA is a first-of-its-kind data protection law in the United States. Modeled after the European Union’s General Data Protection Regulation (“GDPR”), the CCPA provides a number of significant new privacy protections and rights for California consumers. Although limited to “covered businesses” that “do business” in California and process the personal information of California residents, the significance of the CCPA is likely to be much greater as companies globally seek to comply with these requirements. The CCPA will take effect on January 1, 2020; however, enforcement of the Law is delayed to July 1, 2020.

How might the CCPA change?

Over the past year, the California legislature has considered more than 15 amendments to the CCPA, ranging from minor technical tweaks to major changes that would expand the scope of the Law. To date, six amendments have been advanced to the full California Senate for consideration, with one bill (AB 1202) placed on hold due to its fiscal impact on the state. Below is a brief summary of the seven amendments to the CCPA currently being considered:

Temporary Employee Exemption (AB 25): The amendment exempts certain personal information collected by a business about prospective or current employees. However, this is only a temporary exemption, with the exemption sun setting on January 1, 2021. The intention is to ease the impact of CCPA implementation on many businesses.

Preserving Customer Loyalty Programs (AB 846): The amendment clarifies that the CCPA shall not be construed to prohibit businesses from offering additional benefits to consumers in connection with a customer loyalty program.

Modifications to Key Terms (AB 874): The amendment revises two key terms in the CCPA. First, the amendment expands the “publicly available” exclusion under the definition of “personal information” to include information lawfully made available from government records. Second, a revised definition of “personal information” would exclude deidentified or aggregated consumer information.

Exemption for Vehicle Information (AB 1146): The amendment narrowly exempts “vehicle information” and “ownership information” from the rights of opt-out and data deletion in connection with notifications for vehicle recalls and for warranties.

Additional Technical Amendments (AB 1355): The amendment includes a number of technical, corrective, and clarifying amendments—of note these include clarifications about the types of disclosures businesses must make to consumers. For example, the amendment clarifies that a business’ privacy policy must inform consumers they have the right to request the specific pieces of personal information the business has collected on them. The amendment also clarifies that consumers have the right to request from a business the categories of personal information sold to each category of third party.

Modification to Consumer Requests for Disclosure Methods (AB 1564): The amendment modifies an existing provision within the CCPA to exempt businesses that operate exclusively online from a consumer request for information requirement. Specifically, businesses that operate exclusively online will be able to meet the CCPA’s consumer request requirement by providing consumers with an email address only, instead of also offering a toll-free telephone number.

Data Broker Registration (AB 1202): The amendment requires “data brokers” to register with and pay a registration fee to the California Attorney General. A data broker is defined as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.”

Conclusion

We expect some of these mostly technical amendments to be adopted. The CCPA as a whole is moving closer to full implementation and given its breadth and scope, companies are well advised to take the time available to develop the policies and procedures necessary to come into compliance with the CCPA. For companies that have recently gone through the process of upgrading their cybersecurity and data privacy programs to comply with the GDPR, bringing existing policies into compliance with the CCPA is very much a necessary step. For others who have not been subject to the GDPR, they likely face a much heavier lift to come into compliance in the time remaining.

Ice Miller has the professionals and experience to help clients develop cybersecurity and privacy programs to comply with the requirements of the CCPA. To speak to an attorney, please contact Nick Merker or Guillermo Christensen. Nick Merker is a partner and co-chair of Ice Miller’s Data Security and Privacy Practice Group. Guillermo is a partner in Ice Miller’s Data Security and Privacy, and White Collar Defense Practice Groups. 

Ice Miller will continue to monitor the California legislature’s actions on CCPA amendments and provide updates as new developments arise.

Summer associate Angad Chopra contributed to this publication.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader’s specific circumstances.