Understanding the CCPA, part 1
Background and politics
In June of 2018, on the last day to qualify ballot measures for the 2018 ballot, California adopted AB 375, the strongest privacy law in the nation. The new law is modeled somewhat on the European Union General Data Protection Regulation (GDPR), which famously purports to give customers the “right to be forgotten,” and gives consumers several new rights, aiming to bring more control and transparency to the murky trade and use of people's personal data. It also, for the first time, provides consumers with the ability to sue companies that mishandle their data without ever having to prove harm due to the misuse.
The law is the result of the effort of Alastair Mactaggart, a Bay Area real estate mogul who became concerned about consumer privacy after a conversation with a Google engineer. Mr. Mactaggart formed Californians for Consumer Privacy and spent nearly $3.5 million to place an initiative on the 2018 ballot that would aggressively protect consumer privacy in California. By May of 2018 the group had submitted 629,000 signatures to qualify the ballot initiative.
After submitting the signatures, California State Senator Robert Hertzberg and Assemblyman Ed Chau approached Mr. Mactaggart with a proposal that the California legislature would pass legislation addressing consumer privacy concerns if Mr. Mactaggart withdrew the initiative. Mactaggart agreed to try, setting off a whirlwind of drafting and negotiations that lead to a compromise between Californians for Consumer Privacy and the legislature first publicly introduced on June 25, 2018.
With a deadline of June 28, 2018, to withdraw the initiative, the legislature then set to work passing the bill. Opposition was fierce, with tech giants including Google, Facebook, AT&T and Comcast joining the California Chamber of Commerce in opposition. However, faced with the choices of the legislation or a costly ballot initiative battle, enough stakeholders relented. The legislature managed to pass the bill, AB 375, out of both the Assembly and Senate unanimously, and then Governor Jerry Brown signed it prior to the 5 pm deadline.
On the one hand, it is amazing that a small organization managed to bulldoze some of the heaviest hitters in California politics by leveraging the initiative process. On the other hand, there are distinct benefits to legislation over initiatives generally, and AB 375 over the proposed consumer privacy initiative specifically. Mr. Mactaggart’s initiative, if passed, would have imposed additional duties and liabilities on California businesses. In addition, initiatives are harder to amend than regular legislation, which would present particular problems for a complex and evolving issue such as data security.