Written Comments Received During
Total Page:16
File Type:pdf, Size:1020Kb
From: To: Privacy Regulations Subject: RE: Comment on proposed regulatory amendments Date: --Tuesday, October 13, 2020 2:43:22 AM ■ From: Sent: Monday, October 12, 2020 12:58 PM To: '[email protected]' <[email protected]> Subject: Comment on proposed regulatory amendments The proposed addition to§ 999.315 seeks to further complicate the opt-out right regulations, which are already overreaching and invite fraud and abuse, by imposing an additiona l series of confusing stipulations that would make it significa nt ly harder for online businesses to comply in good faith with t he regulations. First, the stipulation proposed in (h)(l) for counting a number of steps is confusing, nonsensical, and completely arbitrary. It would significantly penalize, to no good purpose, businesses like mine that use webforms as a means of processing CCPA requests. By setting an arbitrary standard for number of clicks or number of steps, t his stipulation would arbit rarily pena lize the use of CAPTCHAs or other means to ensu re that the webform is being submitted by a human user rather t han bots, who are drawn to webforms li ke moths to a flame. Since the regulations are written to require that businesses respond prompt ly to ALL requests, even obviously fraudulent ones, this expectation would devastate small businesses like mine. I have only modest online traffic, but if I post a webform without a CAPTCHA or other means of separating huma n users from bots, I may get HUNDREDS of obviously fraudulent spam submissions a day. As a sole proprietor, I simply do not CCPA_3RD1SDAY _ 00001 have the time to handle that volume of responses. Furthermore, this stipulation would effectively require that all means of submitting requests involve the same number of steps, which is obviously and fundamentally ridiculous. For a consumer who has an established ongoing relationship with a business -- for example, a customer who logs into an account with an online retailer -- the process of submitting an opt-in or opt-out request may be as simple as a single click on their account settings page; in that case, the business already knows who the consumer is and has mechanisms in place for managing their information. For a website visitor who does NOT have an established relationship with the business, they will almost certainly need to indicate to the business who they are (and that they’re human) so that the business can respond to and process their request. Once a business has received an opt-out request from a given consumer, processing an opt-in-request from the same individual is an inherently simpler process. These procedures clearly, logically, NECESSARILY involve a different number of steps, so to stipulate that they not only shouldn’t but may NOT by law require a different number of steps is absurd. That is not practical, practicable, or enforceable, and represents a further unwarranted overreach by OAG. I strongly recommend that (h)(1) be struck in its entirety. If OAG attempts to revise the wording of this provision in an effort to clarify this mess, it’s likely to compound rather than resolve the issues it presents. The proposed example in (5)(h) is in some respects even more concerning. I grasp that the intent is to discourage businesses from “burying” opt-out instructions in voluminous text, but stipulating that “the business shall not require to search or scroll through the text of a privacy policy or similar document or webpage” would effectively allow OAG to set arbitrary, undefined expectations for what constitutes excessive “searching or scrolling.” Even a fairly straightforward Do Not Sell My Personal Information webpage, containing specific instructions for submitting requests, may require a fair bit of scrolling if a consumer accesses the page from a mobile phone rather than a desktop computer. It also threatens to penalize businesses for minor technical errors, such as an anchor link (that is, a hyperlink pointing to a specific anchor at a specific position on a given webpage) that fails to correctly resolve due to connection issues beyond the business’s reasonable control. I do not object in principle to the proposed text of section (h), but the illustrative examples offer a disturbing indication that OAG’s intention is to find ways to arbitrarily penalize businesses for minor procedural issues. Many business are striving in good faith to meet the often confounding expectations established in these regulations, but OAG seems determined to make that as difficult as possible. My recommendation is to strike (h)(1) and (h)(5) in their entirety. Regarding the proposed addition to § 999.326, the proposed change is, refreshingly, a straightforward and sensible clarification of the existing text. CCPA_3RD15DAY_00002 CCPA_3RD1 SDAY_ 00003 From: Adam Schwartz To: Privacy Regulations Subject: EFF comments on proposed Cal DOJ regulations re CCPA (OAL file no. 2019-1001-05) Date: Tuesday, October 20, 2020 12:46:38 PM Attachments: 2020-10-20 - EFF comments re Cal DOJ proposed regs re dark patterns.pdf Salutations. EFF submits the attached comments in support of the "dark patterns" regulations proposed by the California DOJ at Section 999,315(h) of the third set of proposed modifications of CCPA regulations, published on October 12. Sincerely, -Adam -- Adam Schwartz | Senior Staff Attorney Electronic Frontier Foundation 815 Eddy St. | San Francisco, CA 94109 | -Pronouns: he/him/his CCPA_3RD15DAY_00004 ELECTRONIC FF FRONTIER E FOUNDATION October 20, 2020 BY EMAIL ([email protected]) Re: EFF comments on proposed Cal DOJ regulations on “dark patterns” (OAL File No. 2019-1001-05) Salutations: The Electronic Frontier Foundation (EFF) writes in support of the proposed regulations from the California Department of Justice (DOJ) to protect against what are commonly called “dark patterns.” These are manipulative user experience designs that businesses use to trick consumers into surrendering their personal data. Specifically, we support the proposed regulations at Section 999.315(h), within the third set of proposed modifications of CCPA regulations, which the California DOJ published on October 12. The California Consumer Privacy Act (CCPA) created a right of consumers to opt-out of the sale of their personal data. Businesses might use dark patterns to hamstring this CCPA right. The proposed DOJ regulations will secure this right by stopping dark patterns. Among other things, the proposed regulations would: • Require opt-out processes to be “easy” and “require minimal steps.” • Ban opt-out processes “designed with the purpose or having the substantial effect of subverting or impairing a consumer's choice to opt-out.” • Limit the number of steps to opt-out to the number of steps to later opt back in. • Ban “confusing language” such as “double negatives” (like “don’t not sell”). • Ban the necessity to search or scroll through a document to find the opt-out button. For more on EFF’s opposition to dark patterns, please see: eff.org/deeplinks/2019/02/designing-welcome-mats-invite-user-privacy-0. For the DOJ’s proposed regulations, please see: oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-text-of-third-set-mod-101220.pdf? Sincerely, Adam Schwartz Senior Staff Attorney 815 EDDY STREET, SAN FRANCISCO, CA 94109 USA phone +1.415.436.9333 fax +1.415.436.9993 eff.org CCPA_3RD15DAY_00005 From: Zoe Vilain To: Privacy Regulations Cc: Pierre Valade Subject: To the attention of Deputy Attorney General Kim - Comments with regards to CCPA Date: Tuesday, October 27, 2020 9:06:48 AM Attachments: 20201027 - 2121 Atelier Inc - comments 3 on CCPA to California GA.pdf To the attention of Deputy Attorney General Kim Dear Deputy Attorney General Kim, Please find attached a letter to your attention containing our comments regarding the third set of proposed modifications to the CCPA regulation. I am available for any queries, Best regards, Zoé Vilain Jumbo Privacy www.jumboprivacy.com CCPA_3RD15DAY_00006 ~ Jumbo Jumbo Privacy Lisa B. Kim 2121 Atelier Inc. Deputy Attorney General 32 Bridge Street, 2nd Floor California Department of Justice Brooklyn, NY 11201 Consumer Law Section – Privacy U. USA 300 South Spring Street, 1st Floor Los Angeles, CA 90013 USA October 27th, 2020 By email ([email protected]) Subject: Written comments regarding the proposed CCPA regulations Dear Deputy Attorney General Kim, We write to you concerning the third set of proposed modifications to the California Consumer Privacy Act (“CCPA”) made on October 12th, 2020. As mentioned in our previous letters to you dated respectively February 25, 2020, and March 27th, 2020, 2121 Atelier Inc. d/b/a Jumbo Privacy1 has been acting as registered Authorized Agent in California for California residents, thanks to the introduction of such a role in the CCPA on Feb 1, 2020. Jumbo Privacy notably represents California consumers who request deletion of their personal information from consumer-selected businesses falling under the scope of the CCPA. Requests sent to a business by Jumbo Privacy on behalf of a consumer all contain the identification of the consumer and a signed mandate executed through and stored by a trusted third-party certifier, authorizing Jumbo to act on behalf of the consumer. As of the date of this letter, 73% of businesses we are sending Requests to, are refusing to comply with our Requests based on the argument that such businesses refuse to comply with third-party requests to delete the personal information and/or require the consumer to take further action directly. Jumbo Privacy has therefore been pushing back against such refusals by quoting sections 1798-135 of the CCPA and § 999.315.e of the California Attorney General text of Regulations and indicating that such refusals are a restriction of consumer’s rights. We are concerned that proposed modifications to the CCPA might highly restrict the efficiency and opportunity for consumers to mandate an Authorized Agent.