Every individual is concerned about protecting their personal data, which is why our state legislators took action and passed the California Consumer Privacy Act (CCPA). This sweeping law will impact each and every one of us when it goes into effect on January 1, 2020.
The new law imposes numerous new data collection and deletion requirements on even very small businesses. The State Legislature passed this law in just one week, causing many unintended consequences that need to be fixed or it will end up harming businesses and the consumers it is designed to protect.
For example, a business may not treat a customer differently if he or she chooses to have their information deleted. But it is unclear whether this would conflict with loyalty or rewards programs, in which a business offers discounts to frequent customers. This uncertainty may force many businesses to exclude Californians from their loyalty programs to avoid being sued.
This is why the Santa Monica Chamber of Commerce supports Assembly Bill 846 by Assemblymembers Burke, Low and Mullin. This legislation will explicitly clarify that consumers can maintain their right to privacy and access to their data while still allowing them to participate in their favorite loyalty and rewards programs.
In addition, some of the most popular rewards programs give customers reciprocal benefits with other merchants. For example, some supermarket rewards members earn discounts on gasoline or frequent flier miles that may be used with other travel-related partners. These may also be jeopardized without the passage of AB 846.
Another aspect of the CCPA that needs clarification is that it currently defines “consumer” as any California resident. This definition could cause undue burdens on many of Santa Monica’s busy small restaurants, markets, retailers and other businesses. For example, “consumer” could also mean employee and small businesses would have to build out a separate database for their employees and job applicants. This could create unintended safety risks as an employee who was dismissed for cause such as for sexual harassment could then ask for all of their data to be deleted. This is why AB 25 by Assemblymember Chau is critical, as it will ensure that consumer does not mean employee.
Furthermore, there is a needed clarification about what data a small business is expected to collect and store. As it stands right now, any consumer could ask for their information to be deleted and currently a business must be able to fulfill that request and delete all information it is capable of accessing and deleting.
This could mean a business would need to figure out how to store security footage or an IP address of a person who visited its website once. Businesses currently do not collect and store this type of information connecting the data to specific individuals. To comply, local businesses may need to collect and store even more data in case a consumer asks for all of their information to be deleted. This places an undue burden on small businesses and would be viewed as a violation of the CCPA, which would result in steep financial penalties – even if the violation was inadvertent.
This is why we also support AB 873 by Assemblymember Irwin that clarifies that a business only needs to delete information that is reasonable for them to access and delete. This protects consumers as businesses won’t be forced to collect more data, and helps businesses with the significant costs that would be required to comply with these provisions.
There are a number of other fixes that will make a difference in the CCPA for our Santa Monica businesses and ensure consumers’ right to privacy. We appreciated Assemblymember Bloom’s support of these bills and encourage the State Senate to also approve this sensible legislation that will help make our state’s privacy law a model for the nation.
We will be having a Tech Talk Tuesday on July 9 with experts to answer more privacy questions and how the CCPA will work. To attend or learn more go to: http://smchamber.com
For more information on the CCPA visit: MakePrivacy.Work
