On Jan. 1, the California Consumer Privacy Act (CCPA) became effective. Enacted unanimously within hours in 2018 as an alternative to a more menacing ballot initiative promoted by real estate developer Alastair MacTaggart, it is the most sweeping privacy law in the nation.
The CCPA will give California consumers the right to know what personal information a business collects about them; preclude the sale of that information to third parties; delete that information from databases; and be informed of the source of the information, its specific elements and the nature of the third parties with whom it has been shared.
And if California weren’t enough, a gaggle of no less than six other states are preparing to enact copycat legislation when their legislatures reconvene this month or next. If a patchwork of inconsistent state laws results, it could quickly become a business’ worst compliance nightmare.
The CCPA’s enforcement responsibility will be lodged with California’s attorney general, who is authorized to assess civil penalties that can escalate exponentially and virtually without limit in an Internet environment. The CCPA also invites private rights of action as well.
MacTaggart, however, is now planning an encore. Having watched, he says, as “some of the world’s largest companies … actively and explicitly prioritized weakening the CCPA,” he has pledged to avoid the California legislature this time and take his new initiative straight to the voters next November.
His new proposal, if successful, would supplement rather than substitute for the CCPA and would replace the attorney general with a new California Privacy Protection Agency that will be both prosecutor and judge.
The logical reaction to a potential onslaught of state action like this would be for Congress to enact pre-emptive national legislation, creating one consistent and predictable standard for the nation. Several federal proposals have surfaced in Congress, all but one from the Democratic side of the aisle, and, so far, their common theme has been the absence of pre-emption.
The contrast is most vivid with respect to the two leading bills in the Senate, one from the chairman of the Senate Commerce Committee, Sen. Roger Wicker, R-Miss., and the other from its ranking Democrat, Sen. Maria Cantwell of Washington.
Wicker’s bill is pre-emptive and assigns enforcement to the Federal Trade Commission (FTC), with state enforcement authority residing in state attorneys general. There is no private right of action.
By contrast, while Cantwell’s bill also relies on the FTC for primary federal enforcement, it also expands litigating authority to include, not just state attorneys general and private rights of action, but also “a consumer protection officer” of the state. Even The Washington Post has observed that “Democrats want a private right of action” though “even those in the middle fear an onslaught of frivolous lawsuits that enrich trial lawyers rather than consumers.”
In the House, Speaker Nancy Pelosi, D-Calif., supports the California approach, noting that “Republicans ... want pre-emption of state law,” adding, “well, that’s just not going to happen.”
The leading House bill belongs to two of her Democratic Golden State colleagues, Reps. Anna Eshoo and Zoe Lofgren, and its approach to private rights of action includes the recovery of litigation expenses for public interest groups they authorize to bring class action lawsuits.
Virtually every company in the country today collects and utilizes personal consumer data. Wide-ranging consumer benefits, born of efficiencies created by this data, usually flow from this practice. The current absence of a single national standard as well as the looming presence of broadly defined private rights of action, risk substituting stalemate for meaningful progress in Congress.
It may take the failure or mass exodus of businesses from states like California to alter this trend. The Wall Street Journal has reported that 660 California companies have moved 765 facilities out of the state since 2017.
States that announce “open season” on their job creators risk watching that community vote with its feet, a dangerous consequence of expanding enforcement to include “frivolous lawsuits” that are too often motivated by the prospect of lucrative settlements rather than by the facts.