The California legislature just passed one of the most robust data privacy bills in the United States.
Known as the California Consumer Privacy Act of 2018, the bill largely mirrors protections offered to European citizens under the recently implemented General Data Protection Regulation (GDPR). It is likely to drastically change the ways that American companies store and trade in consumer information, at least for Californians.
With lawmakers facing intense pressure, the bill was passed with overwhelming support in both the California State Senate and Assembly. It will now go to Governor Jerry Brown’s desk, where it’s expected to be signed.
Among other provisions, the new law will require companies to declare the types of data they collect from users and with whom that data is shared. It further grants consumers the ability to opt out of having their data sold by companies like Facebook and will prevent those companies from charging consumers money, or providing them with fewer services, if they choose not to allow their data to be sold.
Companies that violate the law, when and if it goes into effect, may face financial penalties imposed by the state for doing so. Moreover, it enables consumers to sue companies for up to $750—under certain circumstances—if there’s an unauthorized breach of their data.
Lawmakers faced intense pressure to vote on the bill Thursday. If they hadn’t, a much stronger version would’ve appeared on the state ballot in November. Over 600,000 Californians signed a petition to get the privacy act on the ballot over the past year, thanks in large part to a $3 million campaign funded by Alastair Mactaggart, a San Francisco Bay Area real estate developer.
In a statement this week, Mactaggart said he planned to withdraw his initiative if the California legislature passed its own solution enhancing Californian’s privacy rights. Even lawmakers who openly opposed the legislative option—some argued, for instance, that it opened companies up to a flood of frivolous lawsuits—ended up voting for the bill to prevent the ballot measure, which polls indicated was likely to pass.
“As the effort to empower Californians with critical privacy protections continues, we are heartened by and appreciative of the participation of many stakeholders and privacy advocates in this process, and look forward to their continued involvement as the vision for greater consumer privacy becomes reality,” said Mactaggart, who chairs the group Californians for Consumer Privacy. “It’s my strong belief that these new California rights will soon extend to the rest of the United States.”
Top internet and telecommunications companies, including Facebook, Amazon, Google, AT&T, and Verizon, all of which profit by selling data belonging to users, at least initially opposed the ballot measure, though Facebook and Verizon both dropped their opposition in May. The bill was likewise opposed by Uber, which, along with Facebook, has been the subject of a recent federal investigation into data-handling practices.
Assemblyman Ed Chau, of the bill’s sponsors, said it would place California “ahead of the curve when it comes to online consumer privacy rights,” as he thanked among others, Common Sense Media, the Consumer Attorneys of California, Consumer Watchdog, and the Center for Humane Technology, which each played a role in crafting the bill.
“You know what everybody? They never thought we could do it,” said State Senator Robert Hertzberg, a very animated public figure, who also sponsored the bill. “That is what’s great and that’s one of the reasons that we had such a problem in the negotiations because it was hard to get people to the table to think that we were serious…”
“This is a huge step forward for California,” Herzberg added, “a huge step forward for people all across the country.”