Sweeping New Privacy Bill on Fast Track in California State Legislature

Two key lawmakers in the California State Legislature have introduced new privacy legislation that is on a fast track to passage and intended to supplant a broad privacy ballot initiative that has been proposed for the November election. Assembly Member Ed Chau and Senator Bob Hertzberg released an amended version of AB375 last Thursday. With very little time or opportunity for input, industry groups pushed back with some proposed changes. The sponsors agreed to some changes and the present version of the bill is available here.

There will be a hearing today in the Senate Judiciary committee and another hearing tomorrow in the Assembly Privacy Committee. The goal of the sponsors and leadership is to rush the bill through this week so it can be signed by Governor Jerry Brown on June 28th, the deadline for withdrawing the initiative. The new legislation will take effect on January 1, 2020 and will not become operative unless the privacy ballot initiative is withdrawn.

The new version of AB375 would establish broad new privacy rules for the collection and use of data in both the online and offline world:

• Consumers would have the right to demand companies provide all of the information that has been collected about them as well as the right to demand the deletion of that information.
• Consumers would have the right to opt out of the sharing of any personal information about them to another company.       
• The proposal has a very broad definition of “personal information” that includes web browsing and app history, biometric information, geolocation data and much more.
• Companies who experience a data breach would be subject to statutory damages of no less than $100 per violation and up to $750 per consumer per incident or actual damages, whichever is greater.  Companies would have 30 days to rectify a breach once notified before a suit could be brought against them.    

The new rules would apply to companies with annual gross revenues in excess of $25 million; personal information about 50,000 or more consumers; or which receive 50% or more of their annual revenues from selling consumers’ personal information.  This is even more expansive than the privacy ballot initiative in regard to coverage.

ANA has been working closely with the California Chamber and other industry groups on these issues.  We remain opposed to the new Chau/Hertzberg bill, which has a number of serious defects.  However, most industry groups have determined that there is a better opportunity to improve this flawed legislation than to successfully oppose the even more seriously flawed ballot initiative.