dream of californication: welcome to the californian ...€¦ · justiciable rights vested in both...

UvA-DARE is a service provided by the library of the University of Amsterdam (http://dare.uva.nl)

UvA-DARE (Digital Academic Repository)

Dream of Californication: welcome to the Californian Consumer Privacy Act

Willliams, J.; Irion, K.

Link to publication

LicenseCC BY

Citation for published version (APA):Willliams, J. (Author), & Irion, K. (Author). (2018). Dream of Californication: welcome to the CalifornianConsumer Privacy Act. Web publication/site, Internet Policy Review.https://policyreview.info/articles/news/dream-californication-welcome-californian-consumer-privacy-act/1351

General rightsIt is not permitted to download or to forward/distribute the text or part of it without the consent of the author(s) and/or copyright holder(s),other than for strictly personal, individual use, unless the work is under an open content license (like Creative Commons).

Disclaimer/Complaints regulationsIf you believe that digital publication of certain material infringes any of your rights or (privacy) interests, please let the Library know, statingyour reasons. In case of a legitimate complaint, the Library will make the material inaccessible and/or remove it from the website. Please Askthe Library: https://uba.uva.nl/en/contact, or a letter to: Library of the University of Amsterdam, Secretariat, Singel 425, 1012 WP Amsterdam,The Netherlands. You will be contacted as soon as possible.

Download date: 24 Mar 2021

https://dare.uva.nl/personal/pure/en/publications/dream-of-californication-welcome-to-the-californian-consumer-privacy-act(53eebe4c-e2b7-4887-b559-489a6215dadd).html

https://policyreview.info/articles/news/dream-californication-welcome-californian-consumer-privacy-act/1351

Dream of Californication: welcome to the Californian Consumer Privacy Act | Internet Policy Review

https://policyreview.info/articles/news/dream-californication-welcome-californian-consumer-privacy-act/1351[10-12-2018 10:32:13]

Dream of Californication: welcome tothe Californian Consumer Privacy Act

16 Oct 2018 by Josephine Williams, Kristina Irion onCalifornia Consumer Privacy Act (CCPA)

The California Consumer Privacy Act(CCPA), slated to enter into force on 1January 2020, borrows some cuttingedge ideas from the EU and others’privacy regimes while also experimentingwith new approaches to data privacy.Importantly, the CCPA envisages anonline advertisement market in whichbusiness are prevented from “gettinghigh on information,” breaches arepromptly notified, and consumers areautonomous participants with the abilityto sell their data at will. Where the CCPAbreaks new ground is in protecting

1

https://policyreview.info/users/josephine-williams

https://policyreview.info/users/kristina-irion

https://policyreview.info/tags/california-consumer-privacy-act-ccpa

https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375

https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375



consumers from retaliation for optingout of the sale of their data. Thus, if itlives up to its potential, the CCPA couldcatalyse a permanent restructuring of theonline data mining business. Ourcontribution will shed light on the newCCPA and offer some observations incomparing it with EU’s General DataProtection Regulation (GDPR).

THE FEDERAL DATA PRIVACY INERTIA

“Try to steal your mind'selation . . . dream of silverscreen quotation”- Red HotChili Peppers

In spite of recent grumblings in politicalWashington following the CambridgeAnalytica scandal there is for the timebeing no expectation that the USgovernment will pass comprehensivefederal legislation governing consumers’data privacy. Political willpower toregulate the societal harms of technologyat the federal level has long been stalled.Since the 1995 closure of the Office ofTechnology Assessment, there has been avoid in federal oversight over the onlinecollection and sale of data. However,over the last decade, the FTC has steppedin to fill the legislative void byinvestigating data breaches and privacyconcerns.

2

3



However, informational privacy isgaining increasing momentum. Recently,the National Institute of Standards andTechnology (NIST), an agency housedwithin the Department of Commerce,announced plans to develop federalguidelines for the protection ofconsumers’ online data. In early October,2018, Democratic Congressman RoKhanna, who represents Silicon Valley inthe House of Representatives unveiledhis "Internet Bill of Rights", a blueprintfor federal regulation, which wouldoblige tech firms to alert users of databreaches, provide disclosure, consentand portability inter alia. If such afederal law were passed, it wouldoverride, or preempt state regulations,however given deep partisan divisionsand the slow pace of regulatoryinnovation in Washington, the odds ofswift federal action currently appear dim.

As Supreme Court Justice Louis Brandeisaptly pointed out in 1932, the states are“the laboratories of democracy”. WhileUS senators have been grandstanding –and maintaining the status quo --California has been early onexperimenting with data privacy rules.As retold in a New York Times magazinefeature, the creation of California's CCPAis an example of strategic advocacy forchange. In 2018, a group of California

https://www.nist.gov/news-events/news/2018/09/department-commerce-launches-collaborative-privacy-framework-effort

https://khanna.house.gov/media/press-releases/release-rep-khanna-releases-internet-bill-rights-principles-endorsed-sir-tim

https://en.wikipedia.org/wiki/Laboratories_of_democracy

https://www.nytimes.com/2018/08/14/magazine/facebook-google-privacy-data.html



residents, shaken by the recentCambridge Analytica scandal, pressuredlegislators in Sacramento to pass a lawthat would give California consumersmore control over their personal data. However, rather than put the law intothe hands of voters who might havedemanded an even more radicalrestructuring of the online ad industry,the legislature chose instead to negotiateits own version of AB 375 and signed itinto law on 28 June 2018. The new lawprovides a huge leap forward forCalifornia’s citizens and is considered agame-changer for the nation, creatingjusticiable rights vested in bothconsumers and the California AttorneyGeneral.

THE ‘CALIFORNIA EFFECT’

And if you want these kind ofdreams . . . It’sCalifornication (Red HotChili Peppers)

If the state is indeed a laboratory for newideas, the impact of California’s dataprivacy experiment may be monumentalgiven the state’s status as the home toSilicon Valley, one of the world’s largesteconomies, and the second largest statein the US. The positive ripple effect to begained from California’s more stringent

4



standards, what David Vogel has coinedthe ‘California effect,’ refers to theupwards pull higher regulatory standardscan exert on an industry as a whole. Researchers, such as Bilyana Petkova,contend that federalism or (statejurisdiction) can create “races to the top”in data privacy by enabling states to actsooner than the federal government andto cross-pollinate among statejurisdictions. Also, the testing ofinnovative policies at the state-levelallows federal legislators to later adoptpolicies that were particularly successfulat the state level.

Even prior to the passage of the CCPA,California has already been a frontrunnerin driving certain particular data privacypolicies. In 1972, Golden State votersamended their constitution to includethe right to privacy as an “inalienableright”. In 2003, the California OnlinePrivacy Protection Act (CalOPPA)became the first major consumer datahandling law in the United States.CalOPPA focused on the availability ofprivacy policies, compliance withprotective Do Not Track (DNT) settings,and the safe storage of consumers’ data.In 2005, the “Shine the Light” law wasenacted to protect California consumers’private information by requiringtransparency and the disclosure of the

5

http://dx.doi.org/10.2139/ssrn.2637933

https://iapp.org/news/a/unpacking-the-california-ags-guide-on-caloppa/

https://www.epic.org/privacy/profiling/sb27.html



identity of third parties receivingconsumers’ data.

In a sign of its responsiveness to theevolving privacy needs of the digitalmarketplace, California has taken thelead among US states in regulating themobile app economy. In 2012, theAttorney General of California and sixleading app stores struck an agreementto strengthen privacy protections onmobile apps. By ensuring the inclusion ofprivacy policies in mobile apps cateringto a California audience, the mobileprivacy deal was credited with creatingpositive ripple effects beyond Californiaand throughout the app ecosystem.Similarly, the CCPA may also effectivelyraise the bar for data privacy protectionfor non-California residents.

CALIFORNIA’S ELECTRONIC JURISDICTION

Space may be the finalfrontier but it's made in aHollywood basement” (RedHot Chili Peppers)

The CCPA protects only Californiaresidents (humans, not companies) andsolely in their role as consumers in acommercial setting. Like the EuropeanGDPR, the California law relies on theunderlying logic that individuals’ data

6

7

https://www.clarip.com/blog/voluntary-adoption-nationwide-california-privacy/



should be protected according to thewhereabouts of the individual supplyingthe data. Thus, the CCPA applies tobusinesses around the whole world aslong as they reach out to Californiaresidents who are present in their state.This means, for example, a Californiaresident, living in Los Angeles whosedata is sold by a business in India to abusiness in Canada would havejusticiable rights under the CCPA.

Whilst the CCPA only gives protection toCalifornia residents, in practice, theCCPA’s California jurisdiction is likely toraise the bar for users outside ofCalifornia. The CCPA explicitly statesthat businesses are free to market theironline goods and services to non-California residents without providingopt-out buttons or abiding by the CCPA’sdisclosure requirements. However, it willbe difficult to disambiguate dataattributable to California residents fromresidents of other states. Theadministration cost associated withmaintaining separate websites forCalifornia traffic is likely to cause manybusinesses to simply raise their dataprivacy standards for all users.

THE SCOPE OF CCPA

Personal data: The CCPA gives asbroad a coverage to personal information



as the GDPR. Any information capable ofbeing linked indirectly or directly to aparticular consumer or household isprotected. Also similar to the GDPR, theCCPA covers both electronic and offlinedata physically given to companies.

Businesses covered: The CCPA isintended to govern heavy hitters: itapplies to big data brokers, not small andmedium size enterprises and nonprofits.CCPA regulated businesses must be for-profit firms either making over $25million in annual revenue, or businessesholding the personal data of 50,000people, households, or devices; orbusinesses that gain at least half of theirrevenue from the sale of personal data.

Business purpose exception: Mostinternal collection and use of data can beshielded from opt-out under the so-called business purpose exception.Generally, businesses need not seekconsent for one-time transactions suchas payments with a credit card andinteractions in which the data is not soldor retained or where the data collecteddoes not meet the definition of personaldata. Also, the CCPA does not envisionan end date for the internal use of data,enabling businesses to hold consumers’personal information indefinitely. Bycontrast the GDPR regulates all instances



of personal data processing irrespectiveof whether it is internal to anorganisation’s business or involvespersonal data shared with third parties.However, as explained below, CCPAprotected consumers will have the rightto disclosure of their data collected for abusiness purpose.

CCPA’S IMPACT

This is what you’re craving . .. Californication (Red HotChili Peppers)

Gone are the days when Californiaconsumers unwittingly forked over theirpersonal information to powerful techplatforms only to lose track of their datawhen it was sold further on. The CCPAempowers consumers to say no to thesale of their own data. By contrast, theEU’s GDPR approaches data privacyfrom a comprehensive human rightsframework, offering a high level ofprotection throughout the lifecycle ofresidents’ personal data from themoment of its collection, in relation toeach use and until its eventual deletion.Still the CCPA improves transparency,allowing consumers to obtain a portablecopy of their data and to discover who isholding which of their data, and for whatpurpose.



One feature unique to the CCPA is aprovision that protects consumers fromretaliation if they opt out of the sale oftheir data. For instance, prior to theCCPA, a person wishing to use onlinemap navigation could be left stranded ifthey declined the business full access totheir personal data. After the CCPA,businesses may no longer downgrade thelevel and quality of services simplybecause a consumer has opted out.Another exciting innovation is the law’sfinancial incentives that encouragebusinesses to compensate consumerswho wish to sell their data.

The major market shift brought by theCCPA resides in the autonomy it restoresto consumers. California consumers willnow have full ‘ownership’ over their owndata, with the right to sell their datashould they so choose. Before the adventof the CCPA, consumers eager to accessthe basic infrastructure of the onlineworld had to sign away their datawithout even realising the value of thepersonal data they gave up. Thatdynamic changes radically under theweight of the CCPA, which specificallymentions the right of businesses to payfor the collection of consumers’ personalinformation. In sum, while platforms areprohibited from downgradingconsumers, the CCPA encourages



practices that allow consumers tomonetise their data. This provision is alaudable step toward strengtheningconsumers’ bargaining power vis-à-visplatforms and raising awareness amongconsumers of the existence of the datamarket.

THE NUTS AND BOLTS OF CCPA

It’s understood thatHollywood / SellsCalifornication (Red HotChili Peppers)

What follows is a primer on CCPA’s mostprominent features, which takentogether, aim to restructure powerasymmetries in the collection, sharingand control of personal information.

Verification of consumer identity:The CCPA requires that only verifiablerequests for the disclosure of aconsumer’s data be honoured. In practiceverifying a consumer’s identity will notbe very complex. The CCPA is generoustoward consumers in its definition ofverifiable requests. Businesses must treatrequests coming from password-protected accounts maintained by aconsumer and made while the consumeris logged-in as verifiable.

https://www.wired.com/story/wired25-jaron-lanier-glen-weyl-radical-equality/



Data requests: Somewhat mirroringthe EU’s right to access, Californiaconsumers may in 2020 request a recordof the types of data a business holds onthem, including information about“business use” and third-party sharing oftheir data. Businesses are to provideportable information that can be readilytransmitted to another business.

Disclosure: Businesses will have toinform consumers of the data they arecollecting from their interactions.Disclosure must include the types of datasold, purpose for its use, and the identityof the third party recipients. Notably,while the business purpose exceptionprecludes consumers from controllingbusinesses internal processing of theirdata, the disclosure provision does allowconsumers to discover which of theirdata businesses have collected and storedfor a business purpose.

Right to ‘Deletion’: Akin to Europe’s“right to be forgotten,” Californiaconsumers may now request erasure oftheir information. Businesses mustinform consumers of this right. Thisright, in combination with the disclosureof data held for internal use, may serveas a strategic counterweight to thebusiness purpose exception. Consumersmay request to know which of their



personal data a business is storing andthen request to have it deleted. However,businesses may use a number ofexceptions to escape compliance withdeletion requests, including completionof a transaction, cybersecurity,debugging, research, free speech, andsome internal analytical use. Sadly, theanalytical use exception could make itextremely difficult for a consumer to getpersonal data stored for internal usedeleted.

‘Right to Say No’ to data sale (opt-out): In a dramatic shift, businesses willnow have to obtain consent fromconsumers -- at or before collection – forthe sale of their personal information.Under the CCPA, consumers may, at anytime, exercise their right to declineconsent to the sale of their personalinformation. Importantly, the CCPAappears to remedy much of theshortcomings of consent boxes byrequiring businesses to place a "Do NotSell My Personal Information" button ontheir websites. The button may be a goodfix for design issues with opt-out boxticking.

Children’s data: Furthermore, the saleof children's data will require express optin, either by the child, if between ages 13and 16, or by the parent if younger than

https://hbr.org/2018/09/stop-thinking-about-consent-it-isnt-possible-and-it-isnt-right

https://hbr.org/2018/09/stop-thinking-about-consent-it-isnt-possible-and-it-isnt-right



that.

Third party liability: The CCPAcreates third party liability when “serviceproviders” and “third parties” processingdata violate consumers’ data privacy byfailing to obtain consent for commercialsale of data or failing to make disclosuresof data breaches. This could become avery important measure to counter themurky practice of third party trackingonline.

Sanctions: While the CCPA is strong onconsumer autonomy, it seems weak onstatutory relief for individual consumers.Failure to address an alleged violationwithin 30 days could lead to a $750 fineper consumer and per incident or actualdamages, whichever is greater. This $750per person fine seems laughablecompared to the GDPR’s whopping 4% ofglobal turnover. Individuals are unlikelyto exercise their right to sue under theCCPA if they only stand to gain $750 as aresult. Legislators could have betterserved individual consumers by creatinga higher threshold for fines in an actionbrought by a single person.

On the other hand, the $750 fine couldhave a strong deterrent effect onaggregate. Class action suits brought byindividuals or the Attorney General could

https://www.technologyreview.com/s/530741/the-murky-world-of-third-party-web-tracking/



make the CCPA put its money where itsmouth is. For instance, if one-third ofCalifornia’s population of 39.5 millionpeople were subject to an undiscloseddata breach, the Attorney General wouldbe able to wrestle back up to about $10billion. Still, to give the CCPA any teeth,the Attorney General of California willhave to settle on a definition of “perviolation” that covers each discrete usageof a person’s data per instance. It isimportant to note, however that the $750statutory fine is not the only availableremedy for a violation of the CCPA.Judges may impose any relief the courtdeems proper, including punitivedamages in amount high enough to deterrepetition of the violation in the future.

NON-DISCRIMINATION FOR EXERCISE OF

RIGHTS: A BIG WIN FOR CONSUMERS

Firstborn unicorn . . . dreamof Californication (Red HotChili Peppers)

A major problem with data privacyregulation is the idea that businessesmay pull back their services under thepretext that compliance is too costly. TheCCPA resolves this risk by protectingconsumers from being denied goods orservices or charged differential pricessimply because they have opted-out of



the sale of their data. In essence,businesses may not punish consumerswith higher prices or lower qualitysimply because they exercise their rightsunder the CCPA.

Yet there is a risk that this strong non-derogation guarantee may be subsumedby the exception that follows it. Theprovision that follows states thatbusinesses may in fact offer variations inlevel or quality of their online goods andservices as long as they can prove thatthe consumer’s data is germane to theadded level of service. Hopefully thisexception will be interpreted narrowly orremoved entirely. For instance, aconsumer who chooses to give a businessher phone number may be contacted bythe company via telephone to ensure sheis happy with the service while aconsumer who opts out of sharing thisdata may not receive customer serviceover the phone. Clearly this exception, ifinterpreted too liberally, risksundermining the guarantee thatcustomers will not lose quality if theyopt-out. It is therefore foreseeable thatthis exception will either be amended,scrapped or litigated after 1 January2020.

PRIVATE RIGHT OF ACTION FOR CONSUMERS

Is it war you’re waging? (Red



Hot Chili Peppers)

Consumers may bring individual or classaction civil lawsuits under the CCPA incases of negligent data breach. Whatlooks revolutionary from the outset,unfortunately appears to erectcumbersome barriers to consumerredress. For instance, consumers mustwait 30 days to see if a business inviolation can “cure” the breach. If withinthese 30 days, a business is able to showit has remedied the problem and if itprovides the consumer an assurance that“no further violations shall occur,” thenthe consumer must desist. Also,consumers must defer to the AttorneyGeneral, to see if the Attorney Generalwishes to prosecute on its own initiativebefore filing suit.

It is also unclear how the AttorneyGeneral will accomplish the Herculeantask of auditing the use of dataoutsourced to “service providers” underthe guise of the business purposeexception. While the Attorney Generalis a formidable prosecutorial authority,its competence is spread over bothcriminal and civil law. Furthermore,funding for CCPA prosecution is to comedirectly out of the fines garnered fromsuccessful prosecutions of data privacyviolations. It is therefore likely that the

8

9



Attorney General of California will lackthe level of resources allocated toEuropean Data Protection Authoritiesthat have been specialising in dataprivacy discipline for years.

CONCLUSION

Destruction leads to a veryrough road, but it also breedscreation. (Red Hot ChiliPeppers)

By shining a light on the collection anduse of data, requiring consent for datasales, and giving greater autonomy toconsumers, the CCPA is the mostremarkable achievement in US dataprivacy law to date. The CCPA’s opt-outprovision makes consumers captains oftheir own ship rather than unwittingstowaways at the mercy of powerfulplatforms. However, the law stillcontains a number of potential loopholesthat need shoring up. For instance, theAttorney General must still address thelaw’s administrability problems, the needfor a sharper definition of businesspurpose, inadequacy of individual fines,the question of how businesses approachthe positioning and prominence of "DoNot Sell My Personal Information"buttons, and vagueness in the non-discrimination protection.



Yet despite these shortcomings, theCCPA overcomes the highest hurdlestanding in the way of data privacy: itcreates demand for rights amongconsumers. Consumers cannot takecontrol of their own data if they do notknow they are entitled to it. The "Do NotSell My Personal Information" buttoncleverly nudges consumers towardexercising their rights by remindingthem that their data is in fact being soldat the same time that it instills a sense ofownership over one’s personal datawhere there previously was none. Thelaw’s incentivising financialcompensation in exchange forconsumers’ sale of their personal data isalso helpful. One can only hope that overtime the sense of entitlement to personaldata rights becomes entrenched suchthat consumers refuse to bear the burdenof big data’s most pernicious negativeexternalities.

The CCPA’s proponents must beapplauded for accomplishing what untilvery recently looked like an implausibleCalifornia dream. The new law is inmany aspects weaker than what ismandated under the European Union’sGDPR but it is not creating conflicts oflaws for transatlantic businesses. In factit is an interesting new lab to observewhether the excesses of today’s online



tracking panopticon can be squeezed forgood between the GDPR and the CCPA.Both instruments share the principledilemma of leaving consumers to micro-manage their data privacy preferenceswhich is another form of non-gratifiedlabour. This necessarily placesindividuals at a strategic disadvantagebecause rights need to be exercised tocome to life.

Footnotes

1. As with the title we are borrowing some lyrics fromthe Red Hot Chili Peppers song “Californication”.

2. See Richard Solove (April 2010). "ReinventingTechnology Assessment: A 21st Century Model"(PDF). Woodrow Wilson International Center forScholars. Retrieved 2010-05-05.

3. See Hoofnagle, C. (2016). Federal TradeCommission Privacy Law and Policy. Cambridge:Cambridge University Press.doi:10.1017/CBO9781316411292

4. Seehttps://www.nytimes.com/2018/06/28/technology/california-online-privacy-law.html

5. Following Vogel, David (1995). Trading Up:Consumer and Environmental regulation in aglobal economy. Harvard University Press..

6. Shine the Light mandated disclosure of a business’privacy policy as well as the identity of the thirdparties accessing consumers’ information. Seehttps://www.epic.org/privacy/profiling/sb27.html

https://www.nytimes.com/2018/06/28/technology/california-online-privacy-law.html

https://www.nytimes.com/2018/06/28/technology/california-online-privacy-law.html

https://www.epic.org/privacy/profiling/sb27.html



7. To qualify as a California resident, a person mustbe in the state for other than a temporary ortransitory purpose, or be domiciled in the state whiletemporarily outside the state.

8. Data breach is defined as unauthorised access andexfiltration, theft or disclosure due to a failure on thepart of the businesses to maintain reasonablesecurity procedures

9. The CCPA makes a distinction between on the onehand “third parties” which purchase consumers’ dataand on the other hand “service providers”subcontracted to serve a data processing for abusiness purpose.

dream of californication: welcome to the californian ...€¦ · justiciable rights vested in both...

Documents