A San Francisco real estate developer has agreed to a last-minute deal to keep his data privacy measure off the November ballot.
The move may help Alastair Mactaggart, the main proponent of the California Consumer Privacy Act, avoid one of the most costly ballot measure fights of the year against Amazon, Google, AT&T, Comcast and other internet behemoths that oppose his proposal.
The ballot initiative, which was likely going to be approved for the November ballot, would require big companies to disclose the type of information they gather on consumers and give people the right to prevent businesses from selling their personal data.
Under the terms of an agreement worked out between Mactaggart and other stakeholders, state lawmakers crafted a bill with a similar effect and plan to vote on it next week. Mactaggart pledged to pull his initiative if Gov. Jerry Brown signs the bill by June 28, the final deadline to withdraw measures from the ballot.
In a statement, Mactaggart said the legislation would accomplish most, but not all of what he sought in the initiative: "This legislation, like the initiative, would provide simple, powerful rights to Californians: 'tell me what you know about me. Stop selling it. Keep it safe.'"
Mactaggart, who has dished out $3.5 million to support his own cause by paying signature gatherers to qualify the initiative, expected his opponents to spend as much as $100 million on the campaign against the Consumer Privacy Act before the Nov. 6 election. As of this week, the opponents of the initiative had given nearly $2.2 million to tank it.
The Committee to Protect California Jobs, which opposes the initiative, declined to comment on the bill and Mactaggart's deal.
Assemblyman Ed Chau, D-Arcadia, amended Assembly Bill 375 on Thursday evening with language on a new data privacy law to appease some of the various stakeholder groups.
The bill allows consumers to tell companies, excluding nonprofits, not to share or sell their personal internet data through an "opt out' function. The measure goes a step further than the ballot initiative and grants people the right to access and request that a company delete their personal data. It also bars companies from selling the information of users under age 16 unless given consent.
AB 375 provides some major concessions to businesses and limits legal damages.
The bill includes language to give a company 30 days to "cure" any alleged violations before the state attorney general can pursue legal action. The attorney general is the only entity allowed to take legal action against companies if they fail to follow the law related to sharing, storing and selling personal information.
The measure caps fines at $7,500 per intentional violation. Twenty percent of any settlement would go into a fund to offset the state's cost of enforcing the law. The other 80 percent would be dispersed to the leading jurisdiction that the Attorney General filed the lawsuit on behalf of.
The bill also creates new rules surrounding data breaches that limit damages at $750 per consumer and incident. The language requires a consumer to give the company 30 days written notice before filing a suit and allows the attorney general to stop the action from going forward. The law doesn't apply to instances in which health information is breached or a consumer pursues a lawsuit to recover money it lost as a result of the breach.
"This is a critical first step in ensuring the privacy of kids, families, and all consumers, and we'll continue to fight to ensure there are strong data privacy regulations in place to protect Californians and all Americans," said James P. Steyer, founder and CEO of Common Sense, a nonprofit and co-sponsor of the bill, in a statement.
Chau said California is leading the "nation in an era of consumer-first protections."