California Proposition 24: Consumer Personal Information Law and Agency Initiative
Summary
California’s Proposition 24 would expand the California Consumer Privacy Act of 2018 (CCPA) by creating the new California Privacy Protection Agency and giving Californians the explicit right to opt-out of data tracking. It would also create a new “sensitive personal information” category to protect individual attributes such as race, sexual orientation or union membership, and create new requirements for businesses to obtain permission from consumers and respond to their complaints about their data. The details are modeled based on the European Union’s privacy regulatory framework, the General Data Protection Regulation (GDPR).
Fiscal Impact
The Legislative Analyst’s Office estimates Prop. 24 would increase state costs by at least $10 million annually, due to the creation of a new state agency. It would also increase state costs by not more than a few million annually due to enforcement costs. There would be some offsetting revenue from fines for violations of the law.
Proponents’ Argument For
Proponents of Proposition 24 argue that current privacy protections are not enough. They say that the world’s largest corporations collect vast amounts of valuable data and information from individuals, often without their knowledge or permission, and they then buy and sell it for their profit. The California Consumer Privacy Act of 2018 was watered down by corporate lobbying and needs to be strengthened, they argue. Prop. 24 would close loopholes in privacy protection and solve the current lack of enforcement. Proponents say it would also make it harder for future special interest laws to undermine your privacy. Prop. 24 would go beyond existing laws that have proved inadequate and would enable the state to provide even better protection in the future, they say. Specifically, Prop. 24 would let individuals prevent businesses from using or sharing sensitive personal information, triple fines for violations involving children’s information, establish the California Privacy Protection Agency to defend these rights and hold companies who violate them accountable, and extend penalties imposed on violators.
Opponents’ Argument Against
Opponents argue that the California Consumer Privacy Act (CCPA) of 2018 was the result of a lot of hard work to protect privacy and has had barely a year to work. They say that now, special interests want the complex, over 50–pages-long Prop. 24 to pass before we even know what is working and what is not. Businesses in California, especially small businesses, have just spent $55 billion to comply with the CCPA, and Prop. 24 would require billions more in spending, some of it undoing the changes just completed and actually weakening consumer privacy, with all those costs being passed on to consumers, they claim.
Opponents say that the worst element of Prop. 24 is that it creates a “pay for privacy” situation where companies could charge consumers to keep personal information private. For example, this change would “allow a business to withhold a discount from a consumer, unless the consumer lets the business harvest granular data about their shopping habits, and then profit on disclosure of that data to other businesses.” Prop. 24 also removes many worker privacy protections for years and creates a new bureaucracy costing over $100 million a year that has less power than the attorney general currently has to enforce privacy laws.
Discussion
California’s Prop. 24 is presented as an attempt to strengthen the California Consumer Privacy Act of 2018 and would create a new set of privacy rights for Californians. But privacy advocates and consumer rights groups are divided on Prop. 24, disagreeing about how necessary it is or effective it would be.
Given that the CCPA was only in effect for one year, there is no detailed assessment of how the new rules have been working. Any estimate of the full effects of CCPA and therefore of Prop. 24, must be based on conjecture. Both sides in the Prop. 24 debate seem to want to improve privacy protections, which are also popular with the public, but they disagree about how to achieve those goals.
The CCPA and Prop. 24 both clearly model their policies on the European internet privacy regime called the General Data Protection Regulation (GDPR). So, it is worth noting how that has fared. Like the CCPA and Prop. 24, the GDPR is very complex and went into effect in 2018, only one year before CCPA went into effect, so the European Commission’s own evaluation says that conclusions are still preliminary. They find that most European Union citizens feel more in control of their privacy and their rights and what they can do to control the use of their personal information. They argue that businesses appreciate having one consistent set of rules. They also identified several ways GDPR should be improved as they have learned what works and what does not.
While the European Commission is fairly happy with its own regulations, it recognizes it is still learning and making changes. The same is certainly true of CCPA in California, even if evaluations have not had time to figure out what has worked and what has not. Prop. 24 would make sweeping changes to a work still in progress, with no apparent data or analysis to back up the need for them.
Third-party evaluations of GDPR raise much bigger concerns about CCPA and Prop 24. Analysts have noted that compliance costs have been staggering, with many companies spending millions of dollars. Overall, some businesses have had to hire significant numbers of personnel just to handle compliance. The same analysis also found GDPR has led to a great deal of forgone tech investments, with tech startups folding or failing to get off the ground. A Brookings Institution analysis argues that GDPR has raised costs and lowered the quality of services for consumers. Given the importance of Silicon Valley to California’s economy, these concerns are important.
Finally, Prop. 24 would establish the California Privacy Protection Agency to enforce new privacy rules. But the state would still have to find funding for it during the tight budgets of the current recession, which creates a powerful incentive for the agency to rely on fines against corporations to fund itself. Since the Googles and Amazons of the world can afford an army of lawyers and tie up enforcement actions against them for months or years, the most fruitful way the agency might look to pay for itself could be to go after small companies who can’t afford to dispute complaints, which would be harmful to the state’s tech industry, workers and the economy.