Key Points

• On May 16, 2019, the California Senate Appropriations Committee held Senate Bill 561 (SB-561) in committee, likely blocking its passage this term.
• SB-561, co-authored by the California Attorney General, would have expanded the private right of action in the California Consumer Privacy Act (CCPA) to include all violations of the law, not just in the data breach context, and would have eliminated the right of businesses to seek guidance from the Attorney General on CCPA compliance.
• The demise of SB-561 ensures that the CCPA will take effect with the governmental enforcement regime intended by the first drafters, rather than a private, class action-driven enforcement regime. This should be welcome news to businesses who will face the compliance challenges that the CCPA poses.

Background

The CCPA, which goes into effect on January 1, 2020, is by far the nation’s strictest and most expansive privacy law. It grants California residents broad and purportedly inalienable rights of consent, access and deletion with regard to their personal information (PI); has an expansive, extra-territorial scope; governs the collection and sale of consumers’ PI; and prohibits discrimination against consumers who exercise rights under the law. The CCPA grants consumers a private right of action only for certain violations arising in the data breach context, and otherwise places responsibility for enforcement on the California Attorney General’s Office. The law, as originally drafted, contemplates a central role for the Attorney General, who is tasked initially with preparing regulations and providing opinions to guide businesses on compliance issues, and then ultimately with broad and exclusive enforcement power outside the data breach context.

In February 2019, Senator Hannah-Beth Jackson introduced SB-561, co-authored by the Attorney General, to amend the CCPA to expand the private right of action to any violation of the law and to eliminate the right of businesses to seek the Attorney General’s guidance on compliance issues. SB-561 also would also have eliminated the 30-day period businesses have to cure alleged violations prior to Attorney General enforcement. A motivating force behind the bill was apparently the Attorney General’s concern over his office’s lack of enforcement resources. The bill faced strong opposition from the start.

Update

On May 16, 2019, the California Senate Appropriations Committee held SB-561 for the year. This likely blocks passage of the bill for this legislative term. There is a chance the bill could be re-introduced next year, during year two of the two-year legislative term.

While SB-561 may be dead for this legislative session, businesses subject to the CCPA should be aware that the enforcement regime will likely be a subject of continued debate in California as the law becomes effective next year. For now though, businesses can rest assured that the law will go into effect with the Attorney General-driven enforcement regime originally intended by the law’s drafters. This should help ensure a more sensible, consumer-focused approach to enforcement, rather than the undirected feast for lawyers SB-561 would have unleashed.

A number of other proposed amendments to the CCPA are pending that, if passed, could affect businesses’ obligations under the CCPA. Proposed changes to the definition of PI and an expansion of the public records exception could help practical implementation. The potential carve out of employees from the definition of “consumer” is an important open issue. Changes related to aggregate and deidentified information could also be significant. Our team is closely monitoring CCPA amendments and can help clients make sense of the fast-changing landscape.