The California Attorney General’s Office (CAGO) is conducting a series of public hearings around the state to gather input on the California Consumer Privacy Act of 2018 (CCPA). We attended the CAGO’s January 25th, 2019 hearing.  The panel of CAGO staff informed those in attendance to anticipate a Notice of Proposed Regulatory Action in the fall of 2019. 

Like the other public hearings that have been conducted regarding the CCPA, the purpose was to allow interested members of the public to put forth comments on the record.  CAGO staff did not respond to comments, or provide details regarding the rule making process for the CCPA.  A diverse cross section of interested parties provided their thoughts, including law firm attorneys, non-profit volunteers, and concerned citizens. 

Based on the comments provided, it is clear that entities that will be affected by the CCPA are taking it very seriously.  Below is an overview of expressed points of interest and concern, many of which were recurring themes:

• Law firms and businesses wanted to know how much record keeping would be required to demonstrate compliance.  Would the CAGO be providing examples of what would be considered enough to demonstrate compliance?
• Consumer groups and individual citizens expressed a desire for strong data protection, that would not only provide for security measures, but would also be enforced, including through penalties for companies that do not comply. 
• Will the so called “non-discrimination” rule, also referred to as the “right to equal service and price” under the CCPA, which prevents discriminating against consumers who exercise their rights under the CCPA, be effective for lower income consumers in light of the financial-incentives exception? 
• How will the financial-incentives exception to the non-discrimination rule be implemented?  What mechanisms will companies need to use to show that they are complying?  One commentator put forth that companies could be made to file annually a report showing on a per consumer basis, the amount of money made by selling the consumer data. 
• How will the enforcement of the law interact with federal laws such as the Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Rule (COPPA)?
• How will the law affect educational technology providers?  How will the enforcement of the law interact with other California laws such as Student Online Personal Information Privacy Act (SOPIPA)? 
• Commentators from the company side encouraged the CAGO to consider whether sufficient technology existed for effective compliance depending on how various aspects of the rule making process took form.  Businesses are clearly taking notice that the CCPA could require certain business models, particularly models that rely on advertising to deliver free or lower priced content or services, to evolve. 

The CAGO will be holding additional public forums as listed here.  A brief power point shown to attendees of the public may be found here.