Alastair Mactaggart, the man behind the California Consumer Privacy Act, has a second act.
Disturbed by the intensity with which ad industry and tech lobbying groups “explicitly prioritized weakening the CCPA,” as Mactaggart put it in an open letter posted to his website, he’s spearheading a new ballot measure for the 2020 California elections.
The California Privacy Rights and Enforcement Act, as the proposal is being called, was submitted on Wednesday on behalf of Mactaggart’s nonprofit, Californians for Consumer Privacy.
CPREA (probably good to get used to seeing that acronym) needs more than 620,000 signatures from California voters to quality for a spot on the ballot.
It’s best to take this initiative seriously. Mactaggart, a California resident and wealthy real estate developer turned avid privacy advocate, reportedly spent more than $3 million of his own money to get enough signatures to snag a spot on the 2018 ballot for what became the CCPA.
He withdrew the measure at the last minute after negotiating a deal with lawmakers that led to the passage of the current CCPA, which has businesses scrambling to comply by the fast-approaching effective date on Jan. 1, 2020.
Mactaggart’s new proposal is meant to buttress the CCPA with additional rights that would make it difficult for deep pocketed technology companies to water down. A law passed through a ballot initiative is much more difficult to modify than one that’s passed through a traditional legislative process.
During the most recent California legislative session, which ended in mid September, members of the legislature proposed more than a dozen bills to amend the CCPA. Less than half were eventually approved by both houses of the California state legislature. They still await the governor’s signature, but the process emphasized that businesses will continue to push for modifications to the law.
What’s in the new initiative?
Click here to read a full text annotated version of the 51-page proposal.
According to Mactaggart’s statement, the new law would:
Create new rights related to the use and sale of “sensitive” personal information, including health and financial info, racial or ethnic origin and precise geolocation, which would require consumers to opt in before that data is sold and give them the right to completely opt out from it being used for advertising.
Triple the CCPA’s fines for violations related to the sale of children’s information and, as the CCPA does, require an opt-in for the collection of data from consumers under the age of 16.
Require greater transparency for automated decision making and profiling, particularly related to employment, housing, credit and politics.
Amend election disclosure laws to include businesses that use a consumer’s personal information to influence the outcome of an election to advance their own political interests (ahem, Cambridge Analytica).
Establish a new authority called the California Privacy Protection Agency to enforce the law and provide guidance to the industry and consumers, as opposed to leaving enforcement up to the attorney general’s office, with its relatively limited resources.
And, finally, require that any future amendments exist to further the law and not water it down.
In sum, “what this new law comes down to is giving consumers the right to take back control over their information from thousands of giant corporations,” Mactaggart wrote in his letter. “The more a company knows about you, the more power it has to shape your life.”
In some cases, this power is exercised in a benign manner, he wrote, such as showing someone an ad for a shoe. In others, the use of data can have great consequences, ranging from which employment opportunities or housing options people see to which candidate they support in an election.
If voters approve the new ballot initiative, the California Privacy Rights and Enforcement Act would take effect on Jan. 1, 2021, one year to the day after the CCPA’s effective date.
What should marketers do?
For now, nothing.
The next big item on the agenda is the release of the draft CCPA implementing regulations expected soon from the California attorney general.
The AG’s office “has made it clear that they continue to focus on that process” and the subsequent comment period that will follow before the regs are finalized, said Gary Kibel, a partner at Davis & Gilbert LLP.
“The new ballot initiative does not alter those plans,” Kibel said, although it’s “something to consider and address if it does make it to the ballot in 2020 and, of course, if it’s approved.”
Beyond attempting to further shore up CCPA, the ballot measure aims to set a proposed path towards potential federal privacy legislation, said Shane Wiley, chief privacy officer at location analytics company Cuebiq, and former VP of privacy at Oath.
“As many legislators have commented publicly, any federal privacy law could not be weaker than CCPA,” said Wiley, who was in the audience at an International Association of Privacy Professionals in Las Vegas on Wednesday when MacTaggart spoke about the initiative publicly for the first time.
