A bill signed into law this week in California will give consumers there more control over their data than anywhere else in the country.
Gov. Jerry Brown signed legislation Thursday that requires companies to tell customers who ask what personal data the company has collected, and any arrangements resulting in anyone else receiving the data. The measure, AB 375, also lets customers ask companies to delete their information.
The new law will require a business to provide information about data in some cases, and authorize consumers to opt out of the sale of personal information. It also will prohibit the business from discriminating against the consumer for exercising their right to not have data kept or sold, “including by charging the consumer who opts out a different price or providing the consumer a different quality of goods or services, except if the difference is reasonably related to value provided by the consumer’s data.”
The bill, known as the California Consumer Privacy Act of 2018, goes into effect Jan. 1, 2020.
The new law heads off what could have been a citizen initiative to do many of the same things in the wake of high profile data breaches. The proposed initiative was withdrawn after the measure was signed.
“A legislative solution, unlike the initiative process, provides the opportunity to strike the appropriate balance between protecting privacy rights and the ability for tech to innovate and provide reliable services now and into the future,” bill sponsor Assemblyman Ed Chau said in a statement.
“Today, California took a historic step in enacting legislation to protect children and consumers by giving them control over their own personal data,” said Chau. “Consumers should have a right to choose how their personal information is collected and used by businesses. It is your data, your privacy, your choice.”
Congratulations to @caprivacyorg!!! Today the California Consumer Privacy Act is law! @EPICprivacy @AsmEdChau #AB375 @SenateHertzberg @SenBillDodd @JerryBrownGov @ashk4n #CaCPA2018 #CaLeg #Privacy pic.twitter.com/mxuAMt39Ix
— Marc Rotenberg (@MarcRotenberg) June 28, 2018
The proposal, however, was opposed by some tech companies, and a leading industry group, TechNet, said the measure needs some improvements between now and 2020.
“While this law adds a significant new layer of privacy protections for California consumers, even its authors have acknowledged it is far from perfect and will need revisions in the months ahead as its consequences and workability are better understood,” TechNet said in a statement. “It is critical that the business community, consumer groups, and the legislature work together over the next 18 months to improve this law so it provides meaningful privacy protections for Californians while also allowing all the benefits and opportunities consumers expect from U.S. technology to continue.
“Policymakers around the country looking at what California has done on this issue should understand that the California legislature’s work is far from finished and that this law remains a work in progress before it takes effect in January 2020,” Technet said.