Eyes on California AG as CCPA Effective Date Nears

Gov. Gavin Newsom (D) “has until Oct. 13 to act on bills sent to him by the Legislature,” emailed a spokesperson. Newsom hasn’t signaled opposition to any of this year’s CCPA bills, the privacy attorneys and officials said. Becerra, expected to put proposed rules out for comment this fall, didn’t comment.

The legislature stuck to parameters of what passed in 2018, OK'ing only “extremely minor” revisions, mostly involving industry-specific exemptions, said Media Alliance Executive Director Tracy Rosenberg. Consumer privacy groups fought off many business-sponsored bills they said would weaken CCPA. Lawmakers also rejected two bills the privacy groups said would tighten the law.

Consumer privacy advocates knew they would have to “fight to make [CCPA] stronger and fight really hard to keep it from getting weaker,” said Electronic Frontier Foundation Legislative Activist Hayley Tsukayama. When the bills EFF supported met strong opposition, privacy groups shifted to defense and blocked many bills they didn’t like, she said. “All told, CCPA will look pretty much the same when it goes into effect as it did when it passed in terms of the protections it provides consumers, and I will consider that a win.”

Businesses were pleased lawmakers didn’t pass a private right of action but wanted more changes to make CCPA more practical, said Wiley Rein’s Joan Stewart, representing tech companies, broadcasters and other businesses. “It’s going to be very difficult to implement and to comply with.” That's even though businesses want to do right by consumers, she said.

“There’s still a lot of ambiguity in the law,” said BakerHostetler attorney Alan Friel, representing advertising and other industries. “There was hope that there’d be more room to navigate based on amendments.” One big disappointment was not passing a bill giving more defined permission for loyalty programs, he said.

One big outstanding issue likely to return to the legislature next year is how the law covers employer-employee and business-to-business relationships, the privacy advocates and attorneys said. Debate on that will continue because lawmakers passed a bill exempting that from the law until Jan. 1, 2021. Employee and B2B carve-outs were important for businesses, which had to put “all these extra layers of compliance into something where you really should never have these rights exercised,” Stewart said. Companies next year will urge lawmakers to make the exemption permanent, she said.

AG Rulemaking

Draft rules could come out “any day,” said Friel. “We’ve heard unofficially it may push into the first week of October.” Rosenberg expects the AG to release proposed rules in October or November, and probably not before the governor signs the bills revising CCPA.

Final rules will probably be out close to the July 1 deadline, Friel said. With at least a 45-day public comment period, final rules by the end of Q1 would be an optimistic guess, Stewart said.

The AG waited nearly a month before publicly posting March comments during the pre-rulemaking stage (see 1904020075 and 1903110042), coming after our Freedom of Information Act request. “The process should be fully transparent, and these comments should be out there immediately,” Stewart said. Friel said “it’s helpful to see everybody else’s comments” since it allows for replies and “meaningful conversation.”

Privacy advocates will watch for attempts to weaken CCPA through the AG process, though Rosenberg thinks that’s unlikely. “My sense of the attorney general’s understanding of their role is that they are unlikely to make those sorts of regulatory innovations, and that they are defining the parameter of their role to be pretty operational and pretty functional,” she said. The rulemaking is to answer what compliance looks like, said Tsukayama. “While there is some leeway for how they interpret” the law, “they can’t make huge, sweeping changes.”

“We’re not going to see changes in the law with the AG rulemaking because that’s not their job,” Stewart agreed. “Their job is to implement the law as currently written.” The AG will focus instead on “how to operationalize the law,” she said. How the AG does that may spur further pushes to revise the law at the legislature, if certain provisions prove onerous or cause consumer confusion, the attorney said.

Friel described Becerra as less constrained: “Unless it is directly contradictory to the statute, and it’s consistent with the intent of the statute, he has broad rulemaking authority.”

Pre-emption

TechNet says Congress should pre-empt CCPA. But business and privacy group representatives don’t see Capitol Hill coming together on the issue soon. TechNet didn’t comment.

“It’s extremely unlikely,” especially given major disagreement about whether federal law should pre-empt state laws, said Stewart. If next year there are conflicting state laws -- for example, if Washington state revives and passes its privacy bill (see 1904180036) -- there will be more incentive for Congress to step in, said Friel.

“The general basis for pre-emption is that you pass a federal law that covers some of the same territory,” Rosenberg said. One never knows with the Trump administration and Republicans in Congress, but it would be surprising if that made it through the Democratic House, she said. CCPA could be stronger, but EFF wouldn’t want a federal law to take away any rights that Californians received, Tsukayama said.

“Those hoping California lawmakers might delay or significantly narrow the scope” of CCPA “were disappointed … when the legislature adjourned without making major changes to the state’s landmark privacy law,” said K&L Gates Thursday. “The legislature’s adjournment increases the urgency of efforts to enact privacy legislation at the federal level, where Congress is quickly running out of time to do something before the end of the year.”