Source: http://www.gamingtechlaw.com/2018/07/new-california-privacy-law-resembles-gdpr.html
Timestamp: 2018-09-25 13:14:52
Document Index: 557497100

Matched Legal Cases: ['§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798']

01 Jul New California privacy law resembles the GDPR and might change US landscape
Posted at 22:28h in Guest Post	by	Giulio Coraggio
US privacy laws might considerably change if new California privacy law is comfirmed due to the similarities of its approach with that provided by the GDPR.
This is a very interesting article from my colleagues Jim Halpert and Andrew A. Kingman previously published here, I hope you will emjoy it.
This pattern changed abruptly this week in California, where both houses of the legislature hastily passed the California Consumer Privacy Act of 2018 (AB 375), a long and confusingly drafted bill of California privacy law that would enshrine in California law a significant number of data subject rights found in the GDPR. Although this law does not take effect for 18 months and could change, it is a major development that companies should study carefully and develop plans for.
The bill’s provisions become operative only if the CA Privacy Ballot Initiative (No. 17-0039), a similar proposal with far greater class action enforcement risk, is withdrawn from the ballot, which is expected to occur by the time of passage.
EFFECTIVE DATE OF NEW CALIFORNIA PRIVACY LAW
Assuming the ballot initiative is withdrawn, the bill’s provisions will become operative on January 1, 2020. AB 375’s 33 page text was released with numerous drafting errors only a week before it was passed (in an effort to pass it by the state’s deadline for withdrawal of the Initiative). The delayed effective date gives the legislature the ability to clarify the text of AB 375 before it goes into effect.
The bill applies to a broader range of “Personal Information” (PI) than found in any other US privacy law, broader even than the same term used in the GDPR. It defines “Personal Information” as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably linked, directly or indirectly, with a particular consumer or household.” The definition consists of a long list of items, including IP addresses, persistent or probabilistic identifiers that can be used to identify a particular consumer or device records of personal property, products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies; Internet or other electronic network activity information, professional or employment-related information; or any consumer profile. The definition excludes public record information, but only if that information is used for a purpose consistent with the purpose for which the information was made publicly available.
It protects “consumers” who are defined as California residents, even if identified only by unique identifier.
It heavily regulates selling “personal information,” and defines the term “sell” broadly, as any disclosure “for monetary or other valuable consideration.”
Right to know (§§ 1798.100, 1798.110): At or before the point of collection, businesses collecting a California consumer’s PI must inform the consumer as to the categories of PI to be collected, and the purposes for which the information will be used. Additional uses or collection of additional data require notice to the consumer. Consumers have the right to request that businesses collecting a consumer’s PI disclose to the consumer the categories and specific pieces of PI the business has collected.
Opt out right (§§ 1798.120; 1798.135): Consumers have the right to opt out of businesses selling their PI. A business must make available, in a form reasonably accessible to consumers: a clear and conspicuous link to the homepage, titled “Do Not Sell My Personal Information.” The link must go to a webpage that enables a consumer to opt out of the sale of the consumer’s PI.
Opt in right (§ 1798.120): The selling of a minor’s PI who is less than 16 years of age is prohibited unless the minor explicitly opts in. In the case of a minor younger than 13 years of age, the parent/guardian is required to opt in.
Anti-discrimination (§ 1798.125): Businesses may not deny goods, charge different prices or rates, provide a different level or quality of service, or suggest that a consumer will receive different prices or service levels based on the consumer’s exercise of his/her rights. In contrast to the Initiative, AB 375 added an exception if the different prices/rates/levels/quality of services provided are reasonably related to the value provided to the consumer by the consumer’s data.1 Financial incentives offered to the consumer for the collection, sale, or deletion of personal data are permitted only with prior opt-in consent by the consumer.
Method of consumer request/business response (§ 1798.130): A business must make available two or more designated methods for requests for information, including at a minimum, a toll-free telephone number and a website address (if the business maintains a website). The business must “disclose and deliver” to the consumer the required information within 45 days, inclusive of consumer request verification. There is a 45-day extension when reasonably necessary, subject to consumer notification. There is also a 90 day extension available to businesses “when necessary” (1798.145).
The disclosure must cover the prior 12-month period preceding the business’s receipt of the request. It must be made in writing, and if the consumer maintains an account with the business, be delivered through that account. A business need not provide these disclosures to the same consumer more than twice in a 12-month period.
Privacy policy disclosures (§§ 1798.130, 1798.135): A business must disclose in its online privacy policy (if it has one), and update at least once every 12 months, a description of a consumer’s rights as stated in this act, as well as the methods for submitting requests; a list of the categories of PI it has collected about consumers in the preceding 12 months; a list of the categories of PI it has sold about consumers in the preceding 12 months; a list of the categories of PI it has disclosed about consumers for a business purpose in the preceding 12 months.
Additionally, a privacy policy must also contain a link to a “Do Not Sell My Personal Information” part of its privacy policy, and in any California-specific description of consumers’ privacy rights.
Data breach expansion/private right of action (§ 1798.150): In contrast to the Initiative, which had very broad class action enforcement regardless of any proof of harm, the privacy provisions of AB 375 are enforced by the state AG. However, one section authorizes3 a private right of action for data breaches involving PI under California’s data security law without any proof of harm. The activity triggering enforcement is unauthorized access and exfiltration, theft, or disclosure of this information as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the business,” a term which is undefined.