California privacy law monumental or deeply flawed?

After the California State Legislature passed AB 375 on June 29, 2018, which was devised to provide Californians with new consumer privacy rights, Californians for Consumer Privacy said it would withdraw the California Consumer Privacy Act ballot initiative through the California Secretary of State's office.

The California Data Privacy Protection Act was passed as an alternative to the ballot initiative, which had been certified for November's elections. The initiative would have become law immediately after Election Day, but the legislation does not take effect until Jan. 1, 2020, giving opponents time to seek changes in the legislature.

The CCP stated the bill achieves greater consumer protection than the initiative, including "the right to know all a consumer's personal information for free twice a year, the right to delete, and opt-in for consumers under 16 years old."

The organization called AB 375 a monumental achievement for consumers. "California [is] leading the way in creating unprecedented consumer protections for the rest of the nation," said Alastair Mactaggart, chairman of CCP. "We are grateful to Governor Jerry Brown and members of the California Legislature, especially bill authors Assembly member Ed Chau, Senator Bill Dodd and Bob Hertzberg, for their tremendous commitment to securing consumer privacy rights for California consumers through this legislation. Californians for Consumer Privacy is proud to have led a people's ballot initiative that helped bring us to this point. … It's my strong belief that these new California rights will soon extend to the rest of the United States."

Serious concerns

The National Retail Federation called the legislation "deeply flawed" and said customer service could be severely hampered if the legislature fails to address retailers' concerns before the measure takes effect in 2020. "This law is objectionable on many levels," NRF Senior Vice President for Government Relations David French said. "This is a deeply flawed measure aimed more at lining the pockets of attorneys than protecting consumers. It will expose businesses to unwarranted lawsuits while potentially taking away many of the innovations and special services consumers have come to expect."

French added that retailers strive to protect their customers' data, but data is the backbone of any good retail business. "Knowing how often your customers shop, what brands and styles they prefer and how much they can afford to spend helps you serve their needs," he said. "Whether it's a preview sale on new offerings, letting them know you have their size back in stock or loyalty programs that offer discounts, these are all services that shoppers value. Under this law, those services could go away, and California's consumers will want to know who's to blame."

Key provisions

Following is a brief summary of key provisions of AB 375. In sets forth the

• Right to know all data collected by a business on you (twice annually free of charge).
• Right to say no to the sale of your information.
• Right to delete your data.
• Right to be informed of what categories of data will be collected about you prior to its collection, and to be informed of any changes to this collection.
• Mandated opt-in before sale of children's information (under the age of 16).
• Right to know the categories of third parties with whom your data is shared.
• Right to know the categories of sources of information from whom your data was acquired.
• Right to know the business or commercial purpose of collecting your information.
• Enforcement by the Attorney General.
• Private right of action regarding data breaches only.

NRF warnings

The NRF stated it was among 29 state and national business groups that sent a letter to members of the California Assembly and Senate yesterday that called the legislation "a serious threat" to the California economy. "The business community has been and remains interested in and dedicated to crafting reasonable privacy legislation," the letter said. "We strongly urge the legislature to consider the numerous problems presented by this bill and to fix them as we move forward."

The NRF went on to say that the legislation places sweeping restrictions on how retailers and other businesses can collect and use information about their customers. Among other provisions, it would allow private citizens to sue retailers in addition to allowing enforcement by state authorities, a move the letter called a "giveaway to trial lawyers" that "exposes California businesses to massive additional liability without providing any corresponding benefit to consumers."

The NRF also warned that the law "prohibits retailers from treating customers who opt out of data sharing any differently from those who do not, a provision that could put an end to retail loyalty programs that offer discounts to members. Consumers could also demand that their information be erased, and retailers are concerned by other provisions involving data breach requirements, definitions of personal information, transparency and consumer access to data."

Editorial Note:

Whether you want to upgrade your POS offerings, find a payment gateway partner, bone up on fintech regs or PCI requirements, find an upcoming trade show, read about faster payments, or discover the latest innovations in merchant acquiring, The Green Sheet is the resource for you. Since 1983, we've helped empower and connect payments professionals, starting with the merchant level salespeople who bring tailored payment acceptance and digital commerce tools, along with a host of other business services to merchants across the globe. The Green Sheet Inc. is also a proud affiliate of Bankcard Life, a premier community that provides industry-leading training and resources for payment professionals.

Notice to readers: These are archived articles. Contact information, links and other details may be out of date. We regret any inconvenience.