The 2018 California Consumer Privacy Act (CCPA) requires the California Attorney General's Office (AGO) to promulgate regulations related to the CCPA by July 1, 2020. The AGO is holding seven public forums and accepting written comments regarding its CCPA rulemaking. We previously provided summaries of the San Francisco forum ( link) and the Riverside and Los Angeles forums ( link). The AGO held its fifth public forum in Sacramento on February 5, 2019.
- The Sacramento forum was among the best attended to date, with both industry advocates and consumer activists providing detailed comments. Consumer advocates participated to a greater degree than at prior forums.
- As with prior forums, the panel of AGO staff received public comments without directly responding. The AGO has set a deadline of March 8, 2019, to receive any written comments regarding its CCPA-related rulemaking. Information on how to submit comments by email or mail can be found here.
- Unlike prior forums, consumer advocates provided comments suggesting that they are already thinking through potential methods to test compliance with the CCPA. Consumer advocates asked AGO staff to require companies to include specific, detailed information in their consumer-facing privacy policies to assist consumer advocates in, among other things, better understanding how, and with whom, companies are sharing data.
- Comments shared at the Sacramento
forum tracked issues raised at earlier forums, and key themes have
emerged regarding public concerns with AGO rulemaking.
- Industry Concerns.
Key concerns raised by industry advocates include:
- the need to ensure that employees are clearly excluded from the definition of "consumer;"
- the potential risks posed to consumers by including "household" data in the definition of "personal information," including the possibility that members of a household may be able to request information about other members including in sensitive situations (g., domestic abuse);
- the benefits to consumers in enabling companies to offer a range of opt out options, rather than an all-or-nothing approach;
- the need to enable companies to tell consumers what types of specific pieces of information that they have on consumers, without having to risk privacy violations by providing the actual information back to consumers (e.g., telling the consumer that they have his or her social security number without providing that number); and
- the need for the AGO to provide guidance on how companies should verify consumer requests, and the benefit to offering companies a safe harbor from liability if they comply with the AGO verification process.
- Consumer Advocate
Concerns. Key concerns raised by consumer advocates
include:
- that the fee that companies are permitted to charge to consumers who opt out of the sale of their data be truly reasonable and that the companies be required to submit reporting to support the reasonableness of their fees; and
- that companies be forced to adopt a streamlined and easily understood opt-out process, including by working toward a global opt-out option.
- Industry Concerns.
Key concerns raised by industry advocates include:
The AGO will hold the next public forum in Fresno on February 13, and the last public forum at Stanford is scheduled for March 5. Information about the upcoming hearings can be found here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.