THE ESSENTIAL GUIDE TO CALIFORNIA CONSUMER PRIVACY ACT politicopro.com/california TABLE OF CONTENTS 03 Introduction 04 How California’s Privacy Act will Protect Consumers 06 Who must Comply? 07 Personal Information Protected by CCPA 08 Who is Alastair Mactaggart? 09 Seven Things to Watch Before the End of Session 2 On June 28th, 2018, former Gov. Jerry Brown signed into law Assembly Bill 375, now referred to as the California Consumer Privacy Act, or CCPA for short. The CCPA — the first-ever state data privacy law — is set to go into effect Jan. 1, 2020 and could set a de facto standard for other states’ consumer privacy legislation. The rule gives internet users more control over, and information about, how big companies collect and use their data, and allows the state to fine companies for violations and, under certain circumstances, lets individual Californians sue companies for failing to keep their data secure. Keep reading this guide to get a full download on this unprecedented law, including who the CCPA will impact, how exactly it will protect consumers, and key factors to watch before the end of session. 3 HOW CALIFORNIA’S PRIVACY ACT WILL PROTECT CONSUMERS California’s tough privacy law and the European Union’s sweeping General Data Protection Regulation have emerged as benchmarks in congressional efforts to craft federal privacy standards. California lawmakers, however, have expressed concerns that privacy protections outlined in the state’s legislation could be weakened or preempted by congressional passage of a national data privacy law. Senate Judiciary ranking member Dianne Feinstein (D-Calif.) said she would oppose efforts to water down California’s landmark privacy legislation through federal privacy rules. But Republicans and tech industry leaders are calling for federal preemption of state privacy laws in order to avoid a “patchwork” of regulations. PRIVACY RIGHTS INITIATED BY THE CCPA CCPA expands consumer privacy rights beyond those that typically exist in privacy-related laws, applying to the collection and use of personal information that could be directly or indirectly linked to not just a person but to a household or digital device via unique personal identifiers including customer numbers, IP addresses, pixel tags and mobile ad identifiers. Consumers have more control over how much personal information is collected directly from them or from observed digital behavior, and can hold businesses accountable for misuse of personal information. PRIVATE RIGHT OF ACTION CCPA allows consumers to bring civil actions against businesses if unauthorized access and copying, transferral, removal, theft or disclosure of consumers’ nonencrypted or nonredacted personal information occurs as a result of inadequate security procedures and practices. Consumers may recover damages of between $100 and $750 per incident or actual damages, whichever is greater, and can also seek court orders to stop violators from continuing unauthorized activity. NONCOMPLIANCE FINES IMPOSED Businesses, service providers and persons who violate CCPA face civil penalties of up to $2,500 per violation or $7,500 per intentional violation. Fines will be deposited into a newly-created Consumer Privacy Fund in the General Fund to offset court and Attorney General costs incurred to support enforcement of the law. 4 HOW CALIFORNIA’S PRIVACY ACT WILL PROTECT CONSUMERS cont. INFORMATION COLLECTION DISCLOSURE CONSUMER HAS RIGHT TO REQUEST PERSONAL INFORMATION COLLECTED Businesses who collect and sell California residents’ personal information must disclose to a consumer, upon request — free of charge and up to two times in a 12-month period — specific pieces of information collected about the consumer, collection sources, purpose for collection or selling of information and third parties with which it is being shared and sold. CONSUMER HAS RIGHT TO OPT-OUT OF SALE OF PERSONAL INFORMATION Businesses and third parties must notify consumers that personal information may be sold and provide easily accessible methods to opt-out of sale at any time, free of penalty or denial of services to the consumer for doing so. The opt-out decision must be respected by businesses for at least 12 months before businesses can request that consumers authorize sale of personal information. CONSUMER HAS THE RIGHT TO REQUEST THAT PERSONAL INFO BE DELETED Businesses are required to disclose a consumer’s right to request that personal information be deleted from the records of businesses and third parties with whom the business shared the information. Businesses and service providers must comply with a consumer’s deletion request upon receipt of the request. Sources: California Legislature, California Consumer Privacy Act of 2018, POLITICO staff reports By Cristina Rivero, POLITICO Pro DataPoint 5 WHO MUST COMPLY? For-profit entities who conduct business in California and who collect and process state residents’ personal information must comply with CCPA rules if they meet at least one of three compliance criteria. Businesses do not have to be physically present in the state in order to be subject to the new law. ANNUAL REVENUE For-profit entities in California that acquire $25 million or more in annual gross revenue. PERSONAL INFORMATION Businesses that buy, receive, sell or share the personal information of at least 50,000 consumers, households or devices. REVENUE SOURCE Businesses that at least 50% of annual revenue comes from selling consumers’ personal information. Sources: California Legislature, California Consumer Privacy Act of 2018, POLITICO staff reports By Cristina Rivero, POLITICO Pro DataPoint 6 PERSONAL INFORMATION PROTECTED BY CCPA The law defines personal information as information that may be linked directly or indirectly to a particular consumer, household or to a device that can connect to the internet or to another device. CCPA does not apply to personal information that is publicly available from federal, state or local government records. INFORMATION THAT CAN BE ASSOCIATED WITH A PARTICULAR INDIVIDUAL, HOUSEHOLD OR DEVICE INCLUDING BUT NOT LIMITED TO: • CONSUMER NAME • PERMITTING ACCESS TO FINANCIAL • GEOLOCATION DATA ACCOUNTS • POSTAL ADDRESS • AUDIO, ELECTRONIC, VISUAL, • PROFESSIONAL OR EMPLOYMENT- THERMAL, OLFACTORY OR • EMAIL ADDRESS RELATED INFORMATION SIMILAR INFORMATION • TELEPHONE NUMBER • EDUCATION INFORMATION NOT • DEVICE IDENTIFIER PUBLICLY AVAILABLE • SOCIAL SECURITY NUMBER • IP ADDRESS • HEALTH INSURANCE POLICY • DRIVER’S LICENSE OR CALIFORNIA NUMBER OR SUBSCRIBER • PIXEL TAGS IDENTIFICATION CARD NUMBER IDENTIFICATION NUMBER • MOBILE AD IDENTIFIERS • PASSPORT NUMBER • BIOMETRIC INFORMATION (PHYSIOLOGICAL, BIOLOGICAL OR • INTERNET BROWSING, SEARCH • INSURANCE POLICY NUMBER BEHAVIORAL CHARACTERISTICS AND PURCHASING HISTORY DATA • BANK ACCOUNT NUMBER • USER ALIAS • RECORDS OF PERSONAL PROPERTY, • CREDIT OR DEBIT CARD NUMBER, PRODUCTS AND SERVICES • CUSTOMER NUMBER IN COMBINATION WITH SECURITY PURCHASED CODE, ACCESS CODE OR PASSWORD Sources: California Legislature, California Consumer Privacy Act of 2018, POLITICO staff reports By Cristina Rivero, POLITICO Pro DataPoint 7 WHO IS ALASTAIR MACTAGGART? A real estate developer and investor based in San Francisco, Alastair Mactaggart is considered by many to be the architect and driving force behind California’s new privacy law. HOW HE MADE HIS MILLIONS For the past twenty years, Mactaggart has been a partner at the Emerald Fund, one of the Bay Area’s leading developers. He built his wealth by running a family real estate business with an uncle, developing condos, apartments and shopping centers in California. HOW HE GOT INVOLVED IN PRIVACY According to The New York Times, Mactaggart never worried about the need for consumer privacy laws until having dinner with a friend, a software engineer at Google. Mactaggart asked his friend if he should be worried about how much data big tech companies were collecting about him and expected his friend’s answer to be no. However, his friend’s response was the opposite, saying people would “flip out” if they knew just how much information the companies had on people. From there, Mactaggart began researching and discovered that the United States, unlike some countries, does not have a single and comprehensive law regulating the use of personal data. HOW HE FORCED LEGISLATURE’S HAND Instead of working through the typical Sacramento channels, Mactaggart decided to create a statewide ballot initiative putting the question of data privacy directly in front of the citizens of California. Setting up an office in Oakland, Mactaggart spent nearly $3.5 million gathering signatures to qualify his measure. One week before the deadline to pull his measure, Mactaggart struck a deal with two Democrats, Sen Bob Hertzberg and Asm. Ed Chau. The two Democrats, nervous to leave the decision to voters, worked with Mactaggart on a scaled-back version of the privacy initiative that led to AB 375, or the California Consumer Privacy Act. Sources: Capital Public Radio “Take it or Leave it” and The New York Times “The Unlikely Activist Who Took On Silicon Valley - and Won.” 8 7 THINGS TO WATCH BEFORE END OF SESSION A coordinated campaign to chip away at California’s landmark Privacy Act came to a head this week as numerous industry-backed bills ran into a roadblock: the pro-privacy chairwoman of a key policy committee. But the push is far from over, business groups say. “There are two months to go till the end of session and we’re going to continue to raise these issues,” said Sarah