The Future of California’s Privacy Laws: Proposition 24 – N.Y.U. Journal of Legislation & Public Policy

By: Santana Jackson

November 24, 2020

I. Introduction

In 2018, California became the first state to pass a major comprehensive consumer privacy law titled the California Consumer Privacy Act (“CCPA”). The CCPA guarantees consumers the right to know and access personal information that is being collected about them, to know how that information is being used, the right to delete (with some exceptions) personal information collected from them, the right to opt-out of the sale of their personal information, and the right to non-discrimination for exercising their CCPA rights. Businesses are also required to get consumer or parent/guardian permission to sell the personal information of those individuals who are under the age of 16; for those individuals under the age of 13, parent/guardian permission is required.¹ There is also a right to non-discrimination when users exercise their privacy rights guaranteed by the law (i.e. the right to access, delete, or opt out of the sale of their personal information), but there are exceptions in which businesses may offer financial incentives for the collection or sale of personal information.

Californians voting in November 2020 were able to vote on a new initiative entitled Proposition 24 (“Prop 24”), formally known as the California Privacy Rights Act, which purports to build upon and extend the CCPA. This 52-page initiative sparked a contentious fight over the future of privacy protections in the state. Those in favor of Prop 24 declared that the initiative would make current privacy protections even more forceful and set a national standard for consumer protection.² Those opposed to the initiative proclaimed that Prop 24 would not address the problems that they believe lie within the CCPA and created loopholes and standards that the businesses it is supposed to regulate can skirt.³

II. Vote Yes on Prop 24?

Prop 24’s proponents argued that the initiative will give consumers the power to take back control of their personal information. Through a new addition in Prop 24, individuals now have the right to tell businesses to stop using their sensitive personal information such as ethnicity and race, information about health or finances, and precise geolocation. That new addition is what Prop 24’s supporters were heralding as a remarkable change due to the potential to dramatically reduce potential discrimination.⁴ The initiative also triples the current CCPA fines for collecting and selling children’s private information, hypothetically incentivizing companies to diligently protect children’s online privacy.⁵ Companies are also penalized if email and passwords are stolen due to their negligence.⁶

Some of the other notable provisions of Prop 24 include: data minimization rules, which indicate that businesses cannot collect more information than is necessary and required; storage limitations that state that businesses can only keep your personal information for as long as the business says it will; purpose limitations that determine that businesses can only use your personal information for stated purposes; and the right to correction, which gives consumers the right to correct any personal information a business may have on them. Moreover, in another move intended to incentivize businesses to take privacy violations more seriously, the initiative removes a 30-day right to cure violations. However, one of the biggest changes to the current consumer privacy protection regime will be the establishment of the California Privacy Protection Agency, which would have the power to enforce these rights and impose penalties for infractions. This agency would have guaranteed funding, be twice as big as the current enforcement by the California Attorney General and be headed by a Chief Privacy Auditor. The agency would undertake annual risk assessments and annual cybersecurity audits of businesses whose data processing poses a high risk to consumer privacy and security.

III. Vote No on Prop 24?

Those against the initiative stated that they dislike how Prop 24 expands “pay for privacy schemes.”⁷ The CCPA already allowed businesses to offer financial incentives for the collection of personal information, the sale of personal information or the deletion of personal information.⁸ Prop 24 builds upon the CCPA’s scheme by expanding what businesses may offer to include loyalty, rewards, premium features, discounts or club card programs for the aforementioned processes.⁹ Moreover, Prop 24 will allow businesses to charge consumers different prices, or provide different levels of quality of goods or services, if that difference is reasonably related to the value provided to the business by the consumer’s data.¹⁰ Prop 24’s opponents are worried that those who cannot afford to pay more for privacy may get inferior service, worse connections, slower downloads, and pop-up ads; they are also worried that privacy will become a luxury, disadvantaging low income and older populations.¹¹

Opponents also argue that the law puts the burden on consumers to provide their own privacy by requiring them to ‘opt-out’ of having their information sold or shared on every individual website.¹² This is because companies are allowed to ignore a universal “don’t sell my information” electronic signal. Opponents further assert that under current California law your privacy follows you wherever you go, and this will change under Prop 24 to allow any stored data or information to be collected and used by a business once the user leaves the state.¹³ Other notable arguments against the initiative: Prop 24 runs counter to the promise of data minimization by using business expectations, rather than consumer expectations, as the limit to what personal information is collected; Prop 24 erodes the right to delete by allowing a business to refuse deletion when it believes it could help ensure “security and integrity;” furthermore businesses have a diminished duty to transmit a consumer’s deletion request to a downstream entity if the task requires “disproportionate effort.” Prop 24 also expands the definition of publicly available information to include information collected from social media sources, harkening back to processes used by Clearview AI.¹⁴ Lastly, there is a provision in Prop 24 that overrides a new law that will be in effect in 2021, which is intended to allow workers to know what sensitive information (like fitness, diet, pregnancy tracking app, where you worship, and if you attend a political protest) their employers collect about them and allows employers to continue to gather that information for the next several years.¹⁵

IV. Conclusion

California’s hallmark consumer privacy legislation, the CCPA, went into effect at the beginning of 2020. The law had shortcomings including the California Attorney General’s office, the office previously charged with enforcing the law, had trouble keeping up with more than a few cases and tech companies had found loopholes.¹⁶ The freshly enacted CCPA had barely been able to crawl, but many of the individuals that helped push the legislation through to completion have already enacted another set of provisions through Prop 24. In addition to dealing with the harms that came with COVID-19, many businesses have spent time and energy striving to ensure that they are compliant with the CCPA. I believe that Californians, businesses, and the CCPA deserved more time before another initiative was put into action, at least in order to see what worked to create a more just privacy regime and what did not serve that end. Less than a year, and one as incomparable as 2020, is not enough time to assess faults, successes, shortcomings, and holes in the CCPA.

Furthermore, I believe that while Prop 24 does create some compelling consumer privacy right initiatives, other things about the initiative make me extremely hesitant. A privacy initiative that expands “pay for privacy” schemes is counterproductive. Privacy should be a right for everyone, not for those who have the ability to pay extra or waive offered discounts. To be fair, proponents state that the expansion of what opponents and I call ‘pay for privacy’ schemes is intended to protect newspapers, but I can see this expansion being used by many other industries to exploit low-income individuals. Moreover, relaxing the standards of data minimization and data deletion to accommodate business seems to move away from the sort of privacy protections consumers need in the digital age.

With other states and the nation focusing on what consumer privacy protections are enacted in California, we are ushering in a new era of privacy in our nation. This is a serious task that I think thus far California has done admirably; however, proponents of Prop 24 should not have rushed to enact another set of standards before the current ones could be assessed.

Santana Jackson, J.D. Class of 2021, N.Y.U. School of Law

Suggested Citation: Santana Jackson, The Future of California’s Privacy Laws: Proposition 24, N.Y.U. J. Legis. & Pub. Pol’y Quorum (2020).

1
Office of the Attorney General, California Consumer Privacy Act (CCPA) (2020).
2
Lauren Rosenhall, Privacy Puzzle: Consumer Advocates Divided Over California’s Prop. 24, Calmatters (Oct. 8, 2020), https://calmatters.org/politics/2020/10/consumer-advocates-privacy-prop-24/.
3
Id.
4
How Prop 24 Adds Even More Privacy Rights Compared to the CCPA, Californians for Consumer Privacy (Sep. 24, 2020), https://www.caprivacy.org/how-prop-24-adds-even-more-privacy-rights-compared-to-the-ccpa/.
5
Id.
6
Id.
7
Californians for Real Privacy, What’s Hidden in Prop 24’s 52 Pages of Fine Print, No On Prop 24 (Oct. 14, 2020, 6:41 pm), https://prop24no.org/get-the-facts/#reduces-workers-rights.
8
Submission of Amendments to The California Privacy Rights and Enforcement Act of 2020, Version 3 No. 19-0021, § 1798.125 (2020).
9
Id.
10
Id.
11
Californians for Real Privacy, supra note 4; see Lee Tien et al., Why EFF Doesn’t Support California Proposition 24, Electronic Frontier Foundation, https://www.eff.org/deeplinks/2020/07/why-eff-doesnt-support-cal-prop-24 (July 29, 2020); League of Women Voters’ of California, Prop 24: Consumer Data Privacy (Oct. 14, 2020), https://lwvc.org/vote/elections/ballot-recommendations/prop-24consumer-data-privacy.
12
Californians for Real Privacy, supra note 4.; Lee Tien et al., supra note 7.
13
Id.
14
Supra note 7; Rebecca Heilweil, The World’s Scariest Facial Recognition Company, Explained, Vox (May 8, 2020), https://www.vox.com/recode/2020/2/11/21131991/clearview-ai-facial-recognition-database-law-enforcement.
15
Californians for Real Privacy, supra note 4.; Katy Murphy, These California Privacy Initiative Opponents Might Surprise You, Politico (July 21, 2020), https://www.politico.com/states/california/story/2020/07/21/these-california-privacy-initiative-opponents-might-surprise-you-1302560.
16
Greg Bensinger, A Privacy Measure That’s Hard to Like, N.Y. Times (Oct. 28, 2020), https://www.nytimes.com/2020/10/28/opinion/california-prop-24-privacy.html.