When California passed the nation’s first law giving consumers control over their personal data last year, legislators built in an unusual buffer: an extra year to change the law before it takes effect in 2020.
Lawmakers and lobbyists are now making use of the time, submitting at least 20 bills in recent weeks that would tweak — or, perhaps, ultimately gut — California’s unique privacy protections. Privacy advocates are fighting to make the law even broader, while businesses and tech companies want to see it narrowed. The dynamic could force lawmakers to choose between constituents who overwhelmingly feel they have lost control of how their personal information is collected and used, and businesses (including many campaign donors) who argue that broad privacy protections could fundamentally damage the Internet economy.
The issue landed in Sacramento with huge urgency because of a San Francisco real estate developer named Alastair Mactaggart. Last year — haunted, he has said, by a dinner party chat with a Google engineer who told him Americans would be stunned to know what the tech giant knew about them — he spent $3.2 million to put a data privacy law on the ballot. Tech companies poured $1 million into a campaign to fight it, then decided they’d rather seek a compromise in the Legislature. Lawmakers rushed to pass a privacy law last summer, and Mactaggart pulled his measure off the ballot.
“I was aware when I withdrew the initiative that that would open us up to the possibility of change, both bad and good,” Mactaggart said to a panel of lawmakers last month. “I believe you guys are going to do a great job defending this bill and making sure that when it goes into effect next year, it’s a great bill for California and for the world.”
The law requires that companies tell customers what information it collects about them and to whom they sell the data. It also requires that companies give customers an easy way to opt out of having their data sold, and limits how much more they can charge those who do.
It’s too soon to say exactly how or whether lawmakers will wind up changing the privacy law. Many of the bills that have been introduced are mere placeholders, and it’s still early in the legislative year. A lot can change before lawmakers cast their final votes in September. But a few general themes have already emerged. Here’s what to watch as California’s privacy battle unfolds:
Teeth are a big fight
A key aspect of last year’s compromise between tech companies and privacy advocates was minimizing the opportunity for lawsuits. Under the deal they reached, the law only allows lawsuits over data breaches. But that’s now up for debate, with new bills giving Californians the right to sue companies that break other aspects of the privacy law, such as not letting customers opt out of having their data sold or not deleting data upon customers’ requests.
“In order to make sure they comply with the law, we need to make sure people can exercise their rights,” said Democratic state Sen. Hannah-Beth Jackson of Santa Barbara, who is carrying a bill that would expand the ability to sue under the privacy law. “If you don’t violate the law, you are not going to get sued.”
Big business is likely to push back hard. California Chamber of Commerce lobbyist Sarah Boot said changing the privacy law to allow for more lawsuits would trigger “a class-action bonanza.”
“Frankly, our court system can’t handle that,” Boot said in a hearing before Jackson’s bill was introduced. “California businesses can’t handle it. And the California economy can’t handle that.”
Another flashpoint is a change the tech industry wants: limiting which bits of information consumers can opt out of having sold. Tech companies argue that the law should be narrowed so they can still exchange non-identifiable information with advertisers about, for instance, users’ devices and operating systems.
“Treating this as the sale of personal information jeopardizes the underpinnings of the Internet,” said Internet Association lobbyist Kevin McKinley.
Privacy advocates caution that some changes that seem small may actually weaken the law.
“Powerful tech companies and their clever lobbyists know how complex privacy policies are, and what they may present as a small tweak here and there can fundamentally change the entire law and completely obliterate the rights people have,” said a statement from Jim Steyer, CEO of Common Sense Media, a nonprofit that is part of a coalition of privacy advocates.
Politics aren’t on usual lines
Lawmakers passed the privacy bill last year with a sweeping bipartisan vote, and the issue continues to resonate across the political spectrum.
Republicans, trying to make themselves relevant in a Legislature where Democrats have an enormous majority, have introduced a package of privacy bills, including one that would require social media companies to permanently delete data when people delete their account, and another that would prohibit companies from saving the voice commands people give smart speakers such as Amazon’s Alexa.
GOP Assemblyman Jordan Cunningham said he’s gotten some blowback from business lobbyists who are used to having Republicans on their side.
“Some people are like, ‘What are you guys doing?’” said Cunningham, of San Luis Obispo. “Privacy is a nonpartisan issue to me. It’s a nonpartisan issue to my constituents. When I talk to people in my district, they uniformly want this stuff. They know their data is being used in ways they’re not aware of.”
Democrats control the legislative process, so one political question to watch is whether they allow Republican privacy bills to advance, or quietly kill them by preventing them from coming up for a vote.
The other political question is whether Democrats themselves will split over any of the proposals, as happens on many fights in the Capitol that impact big business.
“I think there will be a real battle between the pragmatists and the idealists,” said Steve Maviglio, a Democratic political consultant who worked on the tech companies’ brief campaign against the privacy ballot measure. “That’s where it’s going to lie.”
This story was written by Laurel Rosenhall of CALMatters. Its original version can be found here.
