A Recap of the Senate Judiciary Committee Hearing on Amending the California Consumer Privacy Act (Guest Blog Post)

July 15, 2019 · by Eric Goldman · in Privacy/Security

by guest blogger Tanya Forsheit, Frankfurt Kurnit Klein & Selz PC

[Eric’s note: it takes super-human dedication to watch a 12+ hour hearing on CCPA amendments. Though I’m willing to do a lot for blog readers, I didn’t have that level of dedication. Fortunately, Tanya Forsheit, a privacy law expert who has deeply invested in the CCPA, took one for the team. She shares her observations here.]

On July 9, 2019, the California Senate Judiciary Committee calendared for hearing eight Assembly bills containing proposed amendments to the California Consumer Privacy Act (“CCPA”). More than 12 hours of hearing later, we know only one thing for certain – the Chair of the Senate Judiciary Committee, Hannah Beth Jackson (Democrat – Santa Barbara) (hereinafter the “Chair”), has made good on her promise to fight any and all amendments to the CCPA, no matter how modest or practical, designed to make it more capable of implementation by the business community. Here is how it went down.

Six of the eight CCPA amendment bills scheduled for hearing on July 9 passed through the Senate Judiciary Committee: AB 25, AB 846, AB 874, AB 1146, AB 1355, and AB 1564. Two of the more significant bills, AB 25 and AB 846, were subject to lengthy discussions and passed only with further amendments limiting their utility. One of the most significant bills, AB 873, which would have made modest modifications to the definitions of personal information, did not pass through Committee. I’ll explain.

* * *

First, a note about procedure . . .

I am not a Sacramento person. I am not a lobbyist. Over the last six months, working on CCPA policy matters and spending a little time in Sacramento, I have learned that everything that happens in Sacramento is very political. But even those seasoned professionals who have worked at the Capitol for many years tell me they have never seen anything quite like what happened on Tuesday, July 9.

The hearing was scheduled to start at 9:30 am, but did not start until an hour later at 10:30 am, after the Chair arrived. The Committee still did not have a quorum at that time but started the hearing and left votes open for others later. The hearing proceeded until lunch and picked up again after 1:30 pm. The Chair intentionally held off on hearing the most significant CCPA bills, AB 873 and AB 846, until after 9:25 pm, skipping over one of those–even though the proposed amendments were supposed to be heard in file order–when the bill’s authors was present. The hearing did not end until well after 10:30 pm that night.

Throughout the hearings on the CCPA bills, the Chair was openly hostile to and combative with the Assembly Member authors of the CCPA amendment bills and the individuals testifying in support of those bills.

It is worth reminding everyone that the business community agreed to the CCPA last year with the understanding, to which the authors of the law agreed, that the problems associated with a bill that was passed in only a week’s time – with no hearings – would be fixed. Yet, it has proved nearly impossible to make any changes that would simply bring the CCPA in line with Obama-era Federal Trade Commission privacy protective positions. Even more disturbing, the Chair has suggested that the CCPA, by far the most stringent privacy law ever passed in the US, is not strong enough (“a weak cup of tea”) and has opened the door to calls from privacy advocates to make it even more problematic for businesses of all sizes, including small mom-and-pop operations and startups seeking to compete with data monoliths.

The California legislature is now on recess until August 12, 2019. Barring something extremely unusual, there will be no further movement on the CCPA bills before then.

* * *

I am going to describe what happened in connection with three of the most closely watched bills – AB 25, AB 846, and AB 873. (For those of you who are interested, AB 1564, which allows exclusively online businesses to offer an email address instead of a toll-free number for consumers to exercise their rights, also passed, with some controversy.)

AB 25

AB 25 adds the following new subsection (g) to the exemptions to the CCPA set forth in Section 1798.145 of the Civil Code:

(g) (1) This title shall not apply to any of the following:

(A) Personal information that is collected by a business about a natural person in the course of the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business to the extent that the natural person’s personal information is collected and used by the business solely within the context of the natural person’s role or former role as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or a contractor of that business.

(B) Personal information that is collected by a business that is emergency contact information of the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business to the extent that the personal information is collected and used solely within the context of having an emergency contact on file.

(C) Personal information that is necessary for the business to retain to administer benefits for another natural person relating to the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business to the extent that the personal information is collected and used solely within the context of administering those benefits.

(2) For purposes of this subdivision:

(A) “Contractor” means a natural person who provides any service to a business pursuant to a written contract.

(B) “Director” means a natural person designated in the articles of incorporation as such or elected by the incorporators and natural persons designated, elected, or appointed by any other name or title to act as directors, and their successors.

(C) “Medical staff member” means a licensed physician and surgeon, dentist, or podiatrist, licensed pursuant to Division 2 (commencing with Section 500) of the Business and Professions Code and a clinical psychologist as defined in Section 1316.5 of the Health and Safety Code.

(D) “Officer” means a natural person elected or appointed by the board of directors to manage the daily operations of a corporation, such as a chief executive officer, president, secretary, or treasurer.

(E) “Owner” means a natural person who meets one of the following:

(i) Has ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a business.

(ii) Has control in any manner over the election of a majority of the directors or of individuals exercising similar functions.

(iii) Has the power to exercise a controlling influence over the management of a company.

(3) This subdivision shall not apply to subdivision (b) of Section 1798.100 or Section 1798.150.

(4) This subdivision shall become inoperative on January 1, 2021.

During the hearing on AB 25, the Chair noted that the author, Assembly Member Chau, had agreed to accept certain recent additional amendments proposed by the Chair. Specifically, these amendments, part of a compromise with organized labor: (1) sunset the provisions after one year; and (2) keep personal information of employees, contractors, job applicants, owners, directors, officers, and medical staff members (and their respective emergency contacts) subject to the disclosure rights set forth in Section 1798.100 of California’s Civil Code and the private right of action for data security breaches set forth in Section 1798.150.

Although the changes set forth in AB 25 are common sense, and California law already protects the rights of employees to access their personnel file, the Chair characterized the subject matter of AB 25 as a “very tricky issue.” She stated that, while employers have good reason to get some information about employees, modern technological “surveillance” allows employers to know a lot more than when an employee has lunch, such as where they are going and who they are meeting. The Chair stated that she looked forward to the effort moving forward to balance this issue, and that her friends in the labor community recognize that this is a discussion that needs to continue moving forward (referring to the sunset amendment).

AB 846

AB 846, generally known as the consumer loyalty program bill, passed, but only with significant amendments to the language that crossed the desk late on July 11. It adds a new Section 1798.126 to the Civil Code, which now reads:

(a) This title shall not be construed to prohibit a business from offering a different price, rate, level, or quality of goods or services to a consumer, including offering its goods or services for no fee, if the offering is in connection with a consumer’s voluntary participation in a loyalty, rewards, premium features, discounts, or club card program.

(b) A business shall not offer loyalty, rewards, premium features, discounts, or club card programs that are unjust, unreasonable, coercive, or usurious in nature.

(c) As used in this section, “loyalty, rewards, premium features, discounts, or club card program” includes an offering to one or more consumers of lower prices or rates for goods or services or a higher level or quality of goods or services, including through the use of discounts or other benefits, or a program through which consumers earn points, rewards, credits, incentives, gift cards or certificates, coupons, or access to sales or discounts on a priority or exclusive basis.

(d) Nothing in this section shall be construed to deny a consumer’s rights pursuant to Section 1798.120.

(e) A business shall not sell the personal information of consumers collected as part of a loyalty, rewards, premium features, discounts, or club card program.

Most significant is the addition of new subsection (e), restricting sales. This provision was added as a result of the discussion during the hearing, detailed below.

The hearing on AB 846 did not begin until after 10:15 pm Pacific Time. It was the second-to-last bill that the Chair called that day. The Chair began the hearing by reiterating how we all love loyalty programs, but expressing concern that organizations running such programs are not disclosing how they use the information. Many of the legislators, including the author, Assembly Member Burke, and the Chair herself, talked about how much they appreciate all of their rewards on Southwest Airlines (as they fly back in forth to their districts with frequency and those points help them and their families). At some point, the Chair discussed how she remembers loyalty programs involving paper stamps that you would lick and collect in a book to get rewards. She expressed nostalgia for a time when the information was not digital and could not be used in other ways.

As has been the case throughout the history of this bill, Margaret Gladstein, a lobbyist representing the California Retailers Association, testified in support of the bill. Ms. Gladstein testified, among other things, that the retailers in that organization do not sell the information.

Witnesses in opposition to the bill included Consumer Reports and Oakland Privacy. The presentation from those organizations was to the effect that individuals who do not want to opt-in to loyalty programs by sharing their information should not have to pay for privacy.

I continue to be highly confused by this bill and the provisions it was designed to clarify. It seems ridiculous to suggest that individuals who do not want to participate in a loyalty program should still get the benefits of a rewards program without sharing their information, but those nuances were not worked out during the hearing. More importantly, the changes set forth in the current version of AB 846 do not impact the existing nondiscrimination provisions set forth in section 1798.125, which created this confusion in the first place. It states that a business shall not discriminate against a consumer because the consumer exercised any of his or her rights by, among other things, charging different prices or rates for goods or services, including through the use of discounts or other benefits, by providing a different level or quality of good or services, or by even suggesting that the consumer will receive a different price or rate for good or services or a different level or quality of goods or services. Although many stakeholders, including Alastair Mactaggart, one of the CCPA’s authors, have stated that they do not interpret section 1798.125 as prohibiting a company from charging individuals who do not opt-in to the program to pay for services, Section 1798.125 remains ambiguous on that point, and AB 846 does not resolve that ambiguity.

Returning to the hearing – Assembly Member Burke, who made a compelling presentation at that late hour, talked about being a single mother and that the legislature should not be taking the position that certain people, like single mothers, cannot be trusted to make their own choices about whether or not to participate in a loyalty program.

After hearing Ms. Gladstein repeat several times that retailers do not sell the information, the Chair asked Member Burke if she would take an amendment to restrict selling. She asked this several times. Member Burke immediately responded with an unequivocal affirmative response.

Legislative counsel added language that crossed the desk late on July 11 that incorporates the restriction on selling. Needless to say, “sell” in this context has the same definition that it has in the rest of the law – which is any making available or otherwise disclosing personal information to another entity in exchange for valuable consideration, monetary or otherwise. There is discussion behind the scenes that the retailers did not mean “sell” in this sense when they testified that they don’t “sell.” It is not clear why they said they do not sell knowing that that is how the Chair interprets the word – as defined in the law. It is not unusual for retailers to share lists of email addresses to create lookalike audiences, and the definition of sell appears to cover this and other data sharing that allows retailers operating such programs to more effectively target ads to participants and others like them. Indeed, many believe that Do Not Sell is meant to be interpreted as Do Not Track, and retailers certainly engage in online behavioral advertising. Given the discrepancy between the definition of sell in the law and how the retailers may have meant it in Ms. Gladstein’s testimony, there is speculation that the retailers may discontinue their support for the bill as modified and that Member Burke may pull it after the recess.

AB 873

AB 873 would have made very modest changes to the definitions of “personal information” and “deidentified.” It would have added the word “reasonably” before “capable of being associated with” in the definition of personal information. And it would have aligned the test for deidentified to make it workable and consistent with the FTC standard.

The Chair skipped over Assembly Member Irwin, the author of the bill, earlier in the evening when she was scheduled to present her bill based on file order. The Chair waited until 9:25 pm Pacific Time, 12 hours after the scheduled start of the hearing, to call Member Irwin.

Member Irwin opened the hearing by noting that AB 873 is the first of two bills designed by the California Chamber of Commerce to bring the business community together. Member Irwin noted that she would not be accepting the Chair’s proposed amendments.

She explained that the bill is designed to address a short list of critical issues that would impede the business community from providing rights to consumers. She referenced the fact that the CCPA was passed in a single week and that it is confusing and presents operational challenges for businesses and consumers. She lamented the process by which the CCPA came to be law.

Member Irwin explained that AB 873 is designed to make the intent of the CCPA workable. She reminded the Chair that she accepted all amendments presented in the Assembly, as a result of which Mr. Mactaggart was neutral on AB 873 in its current form.

She noted that it is important for California to make these changes in order to encourage other states to follow the California model, make sure it is not too overbroad, and reduce the risk of federal law that will preempt state law.

As to “deidentified,” Member Irwin noted that deidentified information is necessary for consumer research. She cited a letter from former FTC Commissioner Jon Leibowitz (from the Obama Administration) issued on the afternoon of July 9 supporting the approach to deidentified set forth in AB 873.

Common Sense Media and the ACLU testified in opposition to the bill. Both testified on the record that the definition of deidentified in AB 873 would include IP addresses and that Member Irwin had stated as such in her materials. This was patently false. IP addresses are explicitly identified as personal information under the CCPA, and AB 873 would not change that. (I am also informed that Member Irwin said nothing to the effect that IP addresses would be deidentified in her written materials.)

Mr. Snow of the ACLU held up his phone and talked about the dangers of a blender ad that follows a consumer around the Internet (although this has nothing to do with the modest modifications to the definitions of personal information and deidentified set forth in AB 873).

In addition to the Chair’s open opposition to the bill, some Senators, such as Senator Maria Durazo, apparently stated that they simply did not understand it (her microphone was not working so it was hard to hear her on the livestream).

The vote was a tie, 3-3, with more than one Senator abstaining. The Chair did not take a second vote, which I am informed is customary in these circumstances. The Chair asked Member Irwin if she was requesting reconsideration and Member Irwin confirmed.

I understand that ordinarily a request for reconsideration means that a bill will remain under consideration for another week and another vote taken. It is not clear what this means under these circumstances given that legislators are out of session from July 12 to August 12, but it appears as a practical matter that AB 873 is dead.

* * *

Bottom line – the CCPA remains the dumpster fire that Eric has associated with each of his blog posts on the CCPA. If you are hoping for more or different amendments successfully gaining traction after the legislature returns from recess on August 12, well . . . don’t hold your breath.

A Recap of the Senate Judiciary Committee Hearing on Amending the California Consumer Privacy Act (Guest Blog Post)

Comments and Pings