Voters Pass Proposition 24 in the State of California

California Consumer Privacy Act

Californians take their personal privacy seriously. On June 28, 2018, the California State Legislature signed into effect the California Consumer Privacy Act (CCPA) to make amendments to Part 4 of Division 3 of the California Civil Code. The CCPA is a statewide statute intended to increase residential privacy rights and reinforce consumer protection for California residents. After passing, amendments were quickly made to the CCPA under Senate Bill 1121, creating the needed changes in September of 2018.

The law was tweaked with additional essential modifications increasing the ability of the CCPA to make a real impact on residents’ privacy. These amendments were passed in October 2019. The CCPA became effective for all businesses that handle data of California residents on January 1, 2020. Companies had till July 2020 to be in compliance with the legislation or face harsh penalties.

The CCPA limits what data can be collected on residents, how it can be used, and the ability to opt out. The CCPA applies to any business that collects consumers’ data. The Act made the following compliance requirements for firms and organizations to follow:

• California residents have a right to know what personal data is being collected about them.
• Individuals have a right to know whether their personal data is sold or disclosed and to whom.
• Citizens of California have a right to say no to the sale of personal data.
• Residents are allowed full access to their personal data.
• In California, anyone can request a business to delete personal information about a consumer collected from that consumer.
• Businesses are not allowed to discriminate against residents for exercising their privacy rights.
  These regulations under the CCPA apply to any businesses that meet the following criteria.
• Has annual gross revenues above $25 million;
• Buys, receives, or sells the personal information of 50,000 or more consumers or households; or
• Earns more than half of its annual revenue from selling consumers’ personal information.
• Organizations are required to “implement and maintain reasonable security procedures and practices” in protecting consumer data.

Voters Pass Proposition 24

During the November 3, 2020 elections, California residents were allowed to add additional protections to the CCPA under Proposition 24. California Proposition 24 was entitled to the Consumer Personal Information Law and Agency Initiative. Residents were given a chance to vote their choice on adding this regulation to California state statutes. The options on the ballot were:

1. Yes – California voters who voted yes, supported the ballot. They chose to support the expansion of the state’s consumer privacy laws. This included allowing consumers to direct businesses not to share their personal data. It removes the time period for companies to be allowed to fix violations before being penalized. It also creates a new state department entitled the Privacy Protection Agency, which would be responsible for enforcing and enacting penalties resulting from the state’s consumer data privacy laws.
2. No – Voters who chose this option opposed the ballot initiative. They were against expanding the state’s consumer data privacy laws or creating the Privacy Protection Agency required to enforce state privacy laws.
   Election results: Passed. Yes votes = 6,526,928 or 56.1% of the vote. No votes = 5,107,806 or 43.9% of the total vote.

Background Details of Proposition 24

The push for the ballot initiative began with Alastair Mactaggart, a San Francisco-based real estate developer. He worked to have this initiative filed. The basics of the regulations and changes to be enacted by the proposition had previously qualified for the ballot in 2018. The California State Legislature withdrew it after negotiations. At that time, the State Legislators passed a revised version of the initiative, which originated from the California Consumer Privacy Act of 2018. Mactaggart contributed more than $3 million to the proposed campaign and used his resources to collect the required number of signatures to get the ballot’s proposal. The average cost per required signature was roughly $4.46.

Mactaggart gave a brief statement regarding his intentions for pushing this ballot to the 2020 election. “My intentions are to go to the ballot. The CCPA of 2018 is a great baseline. But I think there are additional rights that Californians deserve. The only thing I want to make sure is they can’t undo the act. There are basically unlimited resources on one side of the fight. If you don’t do anything, they will win eventually.”

Involved in the negotiations with Mactaggart and others that resulted in the CCPA of 2018, California Senator Bob Hertzberg stated that “there is no reason to negotiate. What Mactaggart is doing is the right thing.” Others felt that the additional ballot initiative was not necessary. Mary Stone Ross, who worked alongside MacTaggart to initiate the CCPA in 2018, made her feelings known in a brief statement. “I firmly believe we wouldn’t have the CCPA had it not been for the ballot initiative process, but I think that now it’s gone too far.”

Some individuals that voted against the initiative had concerns about increased taxes. Others had concerns about loopholes and exceptions as a giveaway to several large companies, including Facebook, social media platforms, and other big tech companies. One opponent of the proposed initiative, Richard Holober, who is president of the Consumer Federation of California, gave voice to their arguments. “No one reads the thousands of words of legal fine print that you have to “Accept” before you can use an app or visit a website. The fine print is where you sacrifice your privacy. The same is true of Proposition 24. Its 52 pages are full of privacy reductions and giveaways to Facebook, social media platforms, and big tech companies that misuse our personal information.”

Some Californians were concerned about a hike in taxes due to the state costs to initialize and maintain the proposition. The state’s fiscal impact would include increased state costs annually of over $10 million to organize the new state agency and retain it. There would also be increased state costs due to the caseload increase that would work its way through the state judicial department’s courts and enforcement. While no new taxes associated with the proposal have been announced, there is some concern about how it will impact state budgets.

Importance of Data Privacy to Residents

While some of the statements about voters by Holober could be true, as many may not thoroughly read the law or understand its implications clearly, one thing remains: California residents are putting up a fight to demand their privacy be respected by corporations and not misused. Understanding the loophole closure that gives breaks to major tech companies may not have been understood.

Mactaggart commented after the election results were known. “We are at the beginning of a journey that will profoundly shape the fabric of our society by redefining who is in control of our most personal information and putting consumers back in charge of their own data.”

California residents are demanding that the state protect them from fraud, abuse, and misuse of their data. With pervasive tracking of individuals, tech companies and others have abused confidential data for many years. While residents are demanding protection, there are additional concerns that the law didn’t go far enough to protect those individuals with low incomes. When read in its entirety, the proposition allows for regulations that could force lower-income consumers to let companies collect their data in exchange for paying less for their access to online services.

Compliance Using Redaction

In this day of technological advances, corporations that value their consumers will initiate a comprehensive data privacy policy within their company. Many tools are available to companies that enhance consumer data protection, and according to the CCPA 2018, the penalties for not protecting residents can be significant. Loopholes for larger corporations defeat the purpose of the bill and the will of the people. Businesses of every type and size can use sanitization and redaction techniques to protect residents’ confidential data. Certain parts of the 2018 version of the CCPA require these redaction policies and levy substantial penalties for those who fail to comply.

When a company faces unauthorized access to their consumer’s data from an outside hacker or another unscrupulous individual, the company is held responsible for the data loss, not the criminal invader. With this in mind, before storing any personal consumer data, it should go through a sanitization process. A thorough and proper redaction of data protects both the consumer and the business. Redaction helps to prevent fraud or misuse of personal consumer data. When a corporation values its consumers, regardless of legislative requirements, it creates a trustworthy relationship. If a corporation misuses personal data, then it will cause resentment in its consumer base.

Though the state enforces privacy policies with penalties, for the customer, this isn’t always enough. Once trust is lost, customers will leave for competitive companies that demonstrate respect. Without the consumer, a company has no route to creating and maintaining its profits. The best way for the relationship between the consumer and corporations to be positive is through respect. When a company uses redaction, sanitization, or encryption methods to protect the people who create its profits, it will come out on top. Way to go, Californians, for recognizing the need to initiate legislation demanding that respect!