California Sets Up Agency to Enforce New Privacy Law, Virginia Follows
Who has the power? California voters, that’s who. The state’s initiative process gives voters the power to put measures on the ballot. If approved, they have the force of law. Proposition 13, which froze the state’s property tax at 1976 levels, is perhaps the most famous but many others have followed, including the law requiring the ubiquitous cancer warning labels that adorn just about everything in California and beyond.
The state’s enormous size — nearly 20 million consumers — means that any statewide law in California affects businesses across the land. It’s just too expensive to produce separate products and services for distribution in California so, as a practical matter, a California measure becomes a national edict.
The latest is something called the California Privacy Protection Act (CPPA), created by voters in 2020. Gov. Gavin Newsome last week named five members to the agency that will be charged with enforcement, which will begin in January 2023.
“Californians deserve to have their data protected and the individuals appointed today will bring their expertise in technology, privacy and consumer rights to advance that goal,” Newsom said in a news release. “These appointees represent a new day in online consumer protection and business accountability.”
Besides the likelihood that businesses operating outside California will abide by the new regulations just to save extra administrative overhead, California voters have also given new incentives to other states, which are beginning to follow suit.
Virginia’s legislature enacted its own Consumer Data Protection Act and Gov. Ralph Northam signed it into law March 2, 2021. At least four other states have similar bills pending in their legislatures and at least a few few are likely to pass this year.
What it does
What does all this really mean to consumers? At its most basic, the new law gives consumers more control of their personal data. It requires businesses to notify California consumers about the personal information they collect.
Attorney General Xavier Becerra enumerates the new consumer rights in a series of bullet points:
- The right to know about the personal information a business collects about them and how it is used and shared;
- The right to delete personal information collected from them (with some exceptions);
- The right to opt-out of the sale of their personal information; and
- The right to non-discrimination for exercising their CCPA rights.
You can find an FAQ with more information on Becerra’s site.
“In an era of massive data mining, the establishment of this body moves us in the direction of protecting people’s digital identities and consumer rights regarding their personal information,” said Assembly Speaker Anthony Rendon. “Special attention needs to be paid to assisting immigrants and non-English proficient Californians to have the same rights as everyone. I am eager to have this board and its capable members go to work.”
Newsom appointed Jennifer Urban, clinical professor of law at the University of California, Berkeley School of Law, to chair the new agency.
Other members include:
- John Christopher Thompson, currently the senior vice president of government relations for LA 2028, which is fashioning a bid for the 2028 Summer Olympic Games to be held in Los Angeles.
- Angela Sierra, a former deputy attorney general in the California Attorney General’s office where she served as chief assistant attorney general of the Public Rights Division.
- Lydia de la Torre, a professor at Santa Clara University Law School and privacy law attorney with the firm Squire Patton Boggs, although she will be leaving the firm to become a member of the CPPA board.
- Vinhcent Le, a technology equity attorney at the Greenlining Institute, an organization working for racial and economic justice.