Over the past several weeks, the California State Assembly has voted in favor of advancing to the California Senate bills that would narrow the reach of the California Consumer Privacy Act (CCPA). Senate bills did not fare as well and have died. Two of the CCPA amendment bills moving forward have the potential to greatly benefit businesses by providing exemptions for employee data and loyalty programs. These bills will become law if passed by the California Senate and ultimately signed by the governor.
As we have previously reported, California legislators have introduced numerous bills to amend the CCPA since it first passed. The "house of origin" deadline - the last day for each house to pass bills introduced in that house - was May 31, 2019. Most significantly, AB 25 proceeded forward, clarifying that the definition of a consumer does not include employees, and SB 561 died, ending (for now) the notion of an expanded private right of action. We will continue to monitor the bills that are proceeding. A summary of what has happened with CCPA amendment bills follows below. In addition, we note the status of several bills that are not CCPA amendments but address privacy issues.
Meanwhile, last week Nevada became the first state to pass a CCPA-inspired law, which was signed into law by the governor and becomes effective on Oct. 1, 2019 - months in advance of the CCPA's effective date. The act, which is less comprehensive than the CCPA, is summarized here.
CCPA Bills That Advanced to the California Senate
The following CCPA amendment bills have been approved by the California Assembly and advanced to the California Senate for consideration in the remainder of the legislative term:
AB 25 - Carving Out Employee Data
As we have previously reported, this bill proposes to amend the definition of a "consumer" to exclude job applicants, employees, contractors (engaged by written agreement) and agents. AB 25 passed the Assembly and was ordered to the Senate on May 29, 2019. On May 30, 2019, it was read for the first time and sent to the Committee on Rules to be assigned.
AB 846 - Exception for Customer Loyalty Programs
The CCPA prohibits businesses from discriminating against consumers for exercising any of their CCPA rights, subject to certain somewhat ambiguous exceptions. This bill, which was amended on April 30, 2019, and ordered to the Senate on May 28, 2019, clarifies that businesses' customer loyalty and rewards programs will be outside the scope of the CCPA's discrimination limitations in most circumstances. AB 846 permits a business to offer a different price, rate, level, or quality of goods or services to a consumer, including offering its goods or services for no fee, if either of the following is true: (1) The offering is in connection with a consumer's voluntary participation in a loyalty, rewards, premium features, discounts or club card program; or (2) The offering is for a specific good or service whose functionality is directly related to the collection, use or sale of the consumer's data. Of note, the bill also restricts a business from offering loyalty, rewards, premium features, discounts or club card programs that are unjust, unreasonable, coercive or usurious in nature. The bill defines a "loyalty, rewards, premium features, discounts, or club card program" as "an offering to one or more consumers of lower prices or rates for goods or services or a higher level or quality of goods or services, including through the use of discounts or other benefits, or a program through which consumers earn points, rewards, credits, incentives, gift cards or certificates, coupons, or access to sales or discounts on a priority or exclusive basis."
AB 873 - Refining the Definitions of 'Personal Information' and 'Deidentified'
This bill, which advanced to the Senate on May 22, 2019, originally narrowed the definition of personal information by removing the term "household" and the phrase "capable of being associated with." However, it has been amended to add these terms back in and to add the term "reasonably" before "capable of being associated with."
This bill would also amend the definition of "deidentified" to mean "information that does not identify and is not reasonably linkable, directly or indirectly, to a particular consumer, provided that the business makes no attempt to reidentify the information, and takes reasonable technical and administrative measures designed to:
(1) Ensure that the data is deidentified.
(2) Publicly commit to maintain and use the data in a deidentified form.
(3) Contractually prohibit recipients of the data from trying to reidentify the data."
This would create a more relaxed standard for deidentification, and a somewhat less broad definition of personal information.
AB 874 - Refining the Meaning of 'Personal Information' and 'Publicly Available'
Ordered to the Senate on May 9, 2019, AB 874 proposes to specifically carve out of the definition of "personal information" consumer information that is deidentified or aggregated. It also changes the meaning of "publicly available" by removing the following sentence from the CCPA: "Information is not 'publicly available' if that data is used for a purpose that is not compatible with the purpose for which the data is maintained and made available in the government records or for which it is publicly maintained."
AB 1564 - Consumer Rights Requests
AB 1564, ordered to the...