Capitol Alert

Sweeping California consumer privacy bill approved by Jerry Brown

Gov. Jerry Brown approved a sweeping consumer privacy bill Thursday afternoon, following a week of tense, behind-the-scenes negotiations and a deal between tech companies and privacy rights advocates.

The new law is a watered-down version of a more expansive initiative proposed by Alastair Mactaggart, a San Francisco real estate developer who spent more than $3 million on his campaign to qualify the measure for the ballot. California lawmakers unanimously passed the measure earlier Thursday, and after Brown's signature, the initiative was removed from the ballot.

"I feel like it's the first step, and the country's going to follow," Mactaggart said. "Everybody is finally waking up to the importance of digital privacy."

Under Assembly Bill 375, which establishes the California Consumer Privacy Act, Californians can hold companies accountable for potential abuse of their data. Members of the public could ask a business to delete information they have on them. Upon request, businesses that sell consumers' information would have to disclose the categories of information they collect. Kids under 16 must opt in to consent to the sale of their data.

The bill also allows individual consumers to sue companies for up to $750 if there is an unauthorized breach of their non-encrypted personal information, despite being written with broader language to give tech companies more legal cover. While consumers can sue for security breaches, the attorney general can levy fines.

State Sen. Jim Nielsen, R-Gerber, criticized the bill, saying he feared it would empower lawyers to file frivolous lawsuits against major companies. He also bashed the process through which it was crafted.

"Here are just a handful of people negotiating something that the majority of legislators will know nothing about," Nielsen said, noting they only had three days to read it. "We are accepting the behind-closed-doors negotiations of various interests."

Despite his concerns, Nielsen voted for the bill, along with 36 senators and 69 assembly members.

State Sen. Bob Hertzberg, D-Los Angeles, is a primary bill sponsor who participated in heated negotiations over the weekend between industry and consumer privacy groups. In a news conference, he called the new law "the most comprehensive privacy law in the country."

While industry groups prefer the bill to the initiative, they remain unhappy.

"It is critical going forward that policymakers work to correct the inevitable, negative policy and compliance ramifications this last-minute deal will create for California’s consumers and businesses alike," said a statement from Robert Callahan, vice president of state government affairs for the Internet Association.

The ACLU said the new law "utterly fails to provide the privacy protections the public has demanded and deserves."

Privacy rights advocates and legal groups praise the bill as a step forward to protecting consumers. Though the legislative process was rushed, they insist the new bill will indeed protect consumers.

"The California Consumer Privacy Act will allow consumers to make informed choices about what happens with their own data — control that fosters a healthy relationship to technology and overall digital well-being," said Elizabeth Galicia, vice president of Common Sense Kids Action.

Brown's signature triggered Mactaggart's move to pull his initiative from the ballot — hours before the secretary of state's initiative deadline. The California Consumer Privacy Act is set to go into effect starting in 2020. Over the next year and a half, lawmakers said they will work to resolve any issues as they emerge, particularly as they relate to potential consumer lawsuits against companies.

Related stories from Sacramento Bee