The new California Consumer Privacy Act (CCPA) will cause unintended consequences that could negatively affect a vast majority of California small businesses. The Chamber joins a growing coalition seeking to apply fixes to the law before it goes into effect in 2020.

The California Consumer Privacy Act (CCPA), a sweeping privacy law that was rushed through the California State Legislature in the summer of 2018, could negatively impact businesses of all sizes across almost every industry.  The bill was written and quickly signed into law in order to prevent a more extreme version of this bill from being placed on the ballot as a statewide measure. As a result, the law is deeply flawed and many of its provisions are simply unworkable in practice or will result in numerous unintended consequences. This year lawmakers in collaboration with business advocacy organizations have introduced several key pieces of legislation to ensure these provisions and unintended consequences are avoided:

AB-874: California Consumer Privacy Act

Position: SUPPORT
Author(s): Assemblymember Jacqui Irwin
Description: Expands the “publicly available” information that is exempted from the definition of “personal information” (PI) in the California Consumer Privacy Act of 2018 (CCPA) to ensure that “publicly available” information includes any information that is lawfully made available from government records.
Why we are supporting it: This bill essentially clarifies the definition as it pertains to lawfully made available data from federal, state, or local government records. Without clarification, the “CCPA creates both practical and constitutional problems for businesses engaged in constitutionally protected activity.”

AB-1564: Consumer Privacy: Consumer Request For Disclosure Methods

Position: SUPPORT
Author(s): Assemblymember Marc Berman
Description: Requires that businesses make available to consumers: 1) a toll-free telephone number or an email address and a physical address, except as otherwise specified; and, 2) if the business maintains an internet website, an internet website, for purposes of submitting their consumer requests for information disclosures, as opposed to both options as is stipulated in the CCPA.
Why we are supporting it: This fix is crucial for small businesses who do not have the resources to staff a 1-800 number. Many businesses covered in the CCPA do not currently have toll-free numbers and obtaining one would be a cost driver. Lastly, receiving and verifying consumer requests via phone calls would present security concerns in many cases.

AB-846: Customer Loyalty Programs

Position: SUPPORT
Author(s): Assemblymember Autumn R. Burke
Description: This bill would clarify that the nondiscrimination section of the CCPA does not result in the elimination of customer loyalty programs. It still maintains the intent of the law that allows consumers to exercise their right under the CCPA and does not weaken or dilute the nondiscrimination provision in any way.
Why we are supporting it: AB 846 would ensure loyalty and rewards programs can continue by fixing language in the CCPA that could make them unlawful. These programs are extremely popular with consumers who choose to belong to them.

AB-873: California Consumer Privacy Act of 2018

Position: SUPPORT
Author(s): Assemblymember Jacqui Irwin
Description: Revises the definition of personal information (PI) in the California Consumer Privacy Act of 2018 (CCPA) to include information that is “reasonably capable of being associated with “a particular consumer or household, as opposed to “capable of being associated with a particular consumer or household.”
Replaces the CCPA definition of “deidentified” to, instead, mean information that does not identify, and is not reasonably linkable, directly or indirectly, to a particular consumer, provided that the business makes no attempt to reidentify the information and takes reasonable technical and administrative measures designed to:

1. 1. 1. Ensure that the data is deidentified.
      2. Publicly commit to maintain and use the data in a deidentified form.
      3. Contractually prohibit recipients of the data from trying to reidentify it.

Why we are supporting it: The CCPA defines personal information too broadly – as any information that is “capable of being associated” with a consumer or household. The breadth of this definition creates an unreasonable burden on businesses. For example, if a customer makes a purchase in a store and later asks the store for access to the customer’s personal information, the store could be required to search security camera footage from the day the customer made a purchase to find where the customer appears on the film and to provide that data to the customer because the business is technically capable of doing so. AB 873 fixes this problem by making the definition of personal information more reasonable – without eroding privacy rights.