Privacy & Information Security Law Blog

In late April, the California state legislature’s Privacy and Consumer Protection Committee held hearings on nine bills that seek to refine the California Consumer Privacy Act of 2018 (“CCPA”) by clarifying the legislation and limiting its scope. Eight bills advanced to the Assembly Appropriations Committee; the ninth is non-fiscal and will next be heard by the full Assembly. Last week, the California Assembly Appropriations Committee approved three of the bills. These bills, now on the Assembly’s “Consent Calendar,” will be heard this week. The Appropriations Committee will hold hearings on the other five bills in the next two weeks.

From the Assembly’s Appropriations Committee, bills must go through the full Assembly, the California Senate and the California governor to be enacted as law.

Key aspects of these bills are summarized below.

• AB 25: would exempt a person’s personal information only to the extent that their personal information is collected and used solely within their employee role (or similar roles within the employment context).
  • Status: on the Assembly’s Consent Calendar
• AB 846: would provide that the CCPA’s discrimination prohibition does not apply if the business’s differential treatment of a consumer is in connection with the consumer’s voluntary participation in a loyalty, rewards, premium features, discount, or club card program, or in connection with a specific good/service whose functionality is directly related to the collection, use, or sale of the consumer’s data.
  • Status: pending before the Appropriations Committee
• AB 873: proposes changes including specifying that “personal information” does not cover all “information that is...capable of being associated” with a particular individual or household, but instead information that “reasonably capable of being [so] associated.” This bill also would revise the definition of “deidentified.”
  • Status: pending before the Appropriations Committee
• AB 874: would create a clear and full public record exemption from the definition of “personal information.” This bill also would clarify that “personal information” does not include consumer information that is deidentified or aggregate consumer information.
  • Status: on the Assembly’s Consent Calendar
• AB 981: would add privacy requirements to the California Insurance Information and Privacy Protection Act (“IIPPA”) to reflect the CCPA and would eliminate a consumer’s right to request that a business delete or not sell personal information under the CCPA if it is necessary to retain or share the personal information to complete an insurance transaction requested by the consumer.
  • Status: pending before the Appropriations Committee
• AB 1146: would exempt from the CCPA certain vehicle information shared between a new motor vehicle dealer and specified parties.
  • Status: pending before the Appropriations Committee
• AB 1355: would amend the CCPA to exclude consumer information that is deidentified or aggregate consumer information from the definition of “personal information.” The bill also clarifies that (1) a consumer’s right to request “specific pieces” of personal information must be disclosed in the business’s online privacy policy or policies, rather than a list of the specific pieces of personal information collected and (2) opt-in consent is required to sell the personal information of children less than 16 years of age (not including children who are 16 years of age).
  • Status: on the Assembly’s Consent Calendar
• AB 1416: would add that the CCPA shall not restrict a business’s ability to do the following (1) comply with any rules or regulations (in addition to federal, state or local laws); (2) share personal information with a government agency solely for the purposes of carrying out a government program (if certain conditions are met); or (3) sell the personal information of consumers who have opted out of sale for the sole purpose of detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity and prosecuting those responsible for that activity (provided that the business or person to whom it is sold does not further sell that information for any other purpose).
  • Status: approved by Privacy and Consumer Protection Committee; date for hearing on the floor to be announced
• AB 1564: requires businesses to make available, in a reasonably accessible form to consumers, a toll-free telephone number or an email address and a physical address for submitting requests for information required to be disclosed under the law. (Online-only businesses need only provide an email address.) If a business maintains a website, the bill requires the business to make the website address available to consumers to submit requests for information.
  • Status: pending before the Appropriations Committee

Separately, the Senate Judiciary Committee has approved SB 561, which would add a private right of action for all violations of the CCPA. SB 561 also would remove provisions in the CCPA that (1) authorize the California Department of Justice to provide compliance guidance to individual businesses or third parties and (2) provide a 30-day cure period for enforcement actions brought by the California Attorney General. SB 561 is supported by Attorney General Xavier Becerra. This bill is currently pending before the Appropriations Committee.