California Consumer Privacy Act (the “Act” or CCPA), the first comprehensive state privacy law of the United States, was enacted by the State of California on June 28, 2018. While a progressive move, CCPA calls for potential, and arguably, much needed, amendments prior to the Act taking effect on January 1, 2020. In this article, we are looking at the enforcement powers vested with the Attorney General (AG) Xavier Becerra under the CCPA and how motivated the AG’s office will be in taking action against businesses who violate consumers’ privacy rights based on comments provided to the public thus far. For a brief overview of the CCPA, click here.
Two essential bills that relate to the AG’s office enforcement powers under the CCPA are (1) Senate Bill 1121, which was passed by the California Assembly on August 31, 2018 following the enaction of the CCPA and amended the CCPA , and (2) Senate Bill 561, that is yet to be passed but have received numerous support from various sectors, including the Electronic Frontier Foundation and AG Becerra himself, who co-authored the bill.[1] SB 561 seeks to expand consumer rights under the CCPA and to eliminate certain requirements for enforcement, discussed in the following three points:
- Expanding the Privacy Right of Action under CCPA
SB 1121, signed by Governor Jerry Brown, allows the AG general to begin enforcing the CCPA either six months after the publication of the AG’s final regulations or July 1, 2020, whichever is earlier. Senator Hannah-Beth Jackson proposes through SB 561 additional rights on the AG’s office and to grant Californians a private right of action for any violation of the CCPA. Presently, the consumer privacy right of action is limited to those who are victims of data breach. On February 25, 2019, AG Becerra, joined by Senator Jackson, expressed their support for SB 561 through a public announcement. They believe that there must be a remedy for Californians allowing them to seek justice directly for themselves in enforcing any of their rights under the CCPA.
AG Becerra, Sen. Jackson Introduce Legislation to Strengthen the California Consumer Privacy Act
As can be seen from the video, AG Becerra emphasizes the fact that they are short on resources to be able to enforce every CCPA privacy compliance case and believes in the enforcement of privacy protections by giving consumers’ a private right of action.
- Elimination of the 30-day cure period
Businesses are currently provided a 30-day cure period to rectify their violations not involving a data breach before an action can be taken against them. SB 561 seeks to eliminate such cure period, a period that AG Becerra calls as a “get out of jail free card.”[2] Without a cure period, the AG and/or California consumer-plaintiffs will be able to sue a business at any time upon violation of consumer privacy rights under the CCPA.
- Removal of legal opinions requirements
Further, the initial version of the CCPA allows businesses to directly request the AG for guidance on their CCPA compliance. Pointing out that such requirement would “unnecessarily divert public funds and resources from enforcement,”[3] SB 561 proposes to allow the AG’s office to publish general guidance to businesses and others to achieve CCPA compliance instead of providing businesses with assurances that their practices comply with the Act.
On May 16, 2019, the California State Senate Appropriations Committee decided to hold SB 561 in committee, which means the bill will not pass out of the Senate this legislative session. Although the bill is defeated this year, Senator Jackson has been working out the language with opponents of the bill and there is a chance the bill could be re-introduced next year.
While the bill is not yet passed, the AG’s support of SB 561 clearly shows his eagerness to strengthen and expand the enforcement rights provided to his office under the CCPA and SB 1121. Businesses should remain prudent as a number of other proposed amendments to the CCPA could result in additional businesses’ obligations under the Act if signed into law.
[1] https://www.eff.org/deeplinks/2019/04/californians-want-and-deserve-stronger-privacy-laws; https://www.akingump.com/en/news-insights/proposed-bill-to-expand-the-ccpa-s-private-right-of-action-dead.html?utm_source=Mondaq&utm_medium=syndication&utm_campaign=View-Original
[2] https://sd19.senate.ca.gov/news/2019-02-25-sen-jackson-ag-becerra-announce-legislation-strengthen-enforcement-privacy
[3] Id.
