With the CCPA having just become effective January 1st, 2020, affected entities and consumers may not have expected that actions are already being taken to dramatically amplify the consumer protections put in place by the CCPA.  Yet Alastair Mactaggart, who led the effort that resulted in the CCPA, via the advocacy group Californians for Consumer Privacy, has put forth a ballot initiative, to be known as the California Privacy Rights Act (CPRA), to do just that.  Alastair’s viewpoint is that, “We’ve laid a historic foundation for consumer rights in California with the passage of the California Consumer Privacy Act, and now it’s time to seize that momentum and take the next step in enforcing and expanding the law to keep pace with an industry that is changing at a break-neck pace,” and “that’s why we’ve introduced a new initiative that will further protect our most personal information, increase fines for violating kids’ privacy, create more transparency and most importantly, establish an enforcement arm that truly looks out for consumers.”  According to a poll provided on the Californians for Consumer Privacy website, 88% of vote in favor of the ballot measure based on a survey conducted October 9-11, 2019. 

As provided by state law, Attorney General Xavier Becerra released the title and summary for the California Privacy Rights Act.  The proposed ballot initiative can be found here.  Previously, Alistair had negotiated with lawmakers to pass what become that CCPA in exchange for dropping the his ballot measure, one week before the 2018 deadline to certify the list of statewide positions.  However, it does not appear that Alistair would be willing to do that again, stating “I don’t think any substantial gains like this are made in the Legislature. I’m really happy what I did [in 2018]. It got us a beachhead. But I like the idea of having a new high-water mark that can’t be undone.”

Here are five important ways that the CPRA ballot measure would expand upon the CCPA:

1. Establish a new enforcement arm called the California Privacy Protection Agency that would in concert with appropriate authorities, have the mandate of enforcing privacy laws and imposing fines. 

2. Businesses would be required to disclose the role automated decision making plays in certain decision making,  including performance at work, economic situation, heath, personal preferences and others, as well as allowing certain opt-out rights with respect the use of these automated decision making processes. 

3. A new category of information called sensitive personal information would be created and would include information regarding sex life and sexual orientation, private communications, health status, geolocation, religion, race, finances, biometrics, and others.  California consumers would receive enhanced rights regarding this sensitive information, including the ability to opt out of its use in marketing and advertising. 

4. Additional protections for the personal information of children would be created, including by a fine of $7,500 for violations where the business, service, contractor or other person has actual knowledge that the affected consumer is under 16 years of age. 

5. Besides mandating further disclosure obligations, it would reinforce that businesses must follow their own disclosures. Somewhat similar to the EU’s GDPR, business would have to disclose their reasons for the types and amount of personal information collected, along with how long this information would be retained. Businesses who used personal information for purposes other than those disclosed, retained it for longer than stated, or collected more information than was needed to offer the relevant service or product would be in violation of the CPRA.

Alastair and the advocacy group Californians for Consumer Privacy have not yet gathered enough signatures to get the proposed ballot measure on the November 2020 ballot. Approximately 623,000 signatures are needed.  While certain aspects of the CPRA could be addressed through a legislative solution even if the ballot measure were to not succeed, it is quite possible the number of signatures needed will be met, especially given Alastair’s success with the 2018 ballot measure. 

We will continue to monitor developments with the CPRA ballot measure as they evolve.