With few exceptions, consumer bills lost this session

Although much publicity has been given to California's new "Yelp Bill" - which makes it illegal for businesses to prohibit, or fine customers for writing, negative online reviews - the legislative year that ended Sept. 30 dealt a number of losses to lawmakers who pursued high-profile consumer products and services legislation.

This year saw the defeat of efforts that would have required companies to provide consumers with more information about products they eat and drink. A proposal to label genetically engineered food failed in the Senate (Senate Bill 1381); legislation to add warning labels to sugary drinks died in the Assembly health committee (SB 1000); and Gov. Jerry Brown vetoed a bill that would have criminalized the sale of mislabeled seafood (SB 1138).

Efforts to expand consumer protection laws also died in the face of industry opposition. Bills that would have amended the Consumer Legal Remedies Act's protection against fraud and deceit to include the suppression or omission of a material fact (SB 1188) and to apply the privacy protections of the Song-Beverly Credit Cart Act to certain online credit card transactions (SB 383) also failed.

A few measures survived, including two signed on the last day of the legislative year.

Data Breach Notification

The first of these new laws, Assembly Bill 1710, amends California's data breach notification law in response to a string of high-profile retailer data breach incidents. As originally introduced, the bill would have, among other things, created strict time frames and requirements for notification of affected customers following a data security breach, required the breached business to offer identity theft protection services at no cost for two years, and imposed limitations on retail payment data retention and storage. In response to stiff opposition by a coalition of business interests including the California Retailers Association and the California Chamber of Commerce, the bill was substantially amended.

Identity theft protection services. Existing law (Cal. Civ. Code Section 1798.80 et seq.) requires a person or entity that owns or licenses computerized data that includes personal information to disclose a security breach following discovery of the breach to any affected California resident. Businesses that have suffered a breach often offer credit monitoring or identity theft prevention services to affected consumers.

As enacted, AB 1710 mandates that if an organization decides to offer identity theft mitigation services, it must do so for at least 12 months at no cost to the individual. Because businesses that choose to provide credit monitoring or identity theft prevention services often already offer these services for free and for at least one year, this amendment is unlikely to change significantly breach response practices.

Security requirements. Current law requires organizations that own or license personal information of California residents to "implement and maintain reasonable security procedures and practices" to protect personal information from "unauthorized access, destruction, use modification, or disclosure." AB 1710 extends these requirements to any organization that maintains personal information of California consumers.

This amendment will primarily affect third-party service providers that obtain personal information from an owner or licensee of that information. In practice, however, the impact of this requirement is likely to be minimal because existing law already requires owners and licensees to contractually impose security requirements on any third party to which they disclose personal information.

Social Security numbers. AB 1710 prohibits selling, marketing, advertising or offering to sell an individual's Social Security number. However, exempted from this ban are releases incidental to a larger transaction and necessary for a legitimate business propose such as running a credit report or as part of a sale of a company. The law also exempts the release of a Social Security number where specifically authorized or required by state or federal law. In practice, this provision will prohibit most sales of Social Security numbers to the public and for marketing purposes except for identity verification and administrative purposes.

Upholstered Furniture Labeling

SB 1019, which was supported by a coalition that included the California Furniture Manufacturers Association as well as firefighters and numerous environmental and health advocates, requires manufacturers of covered products to indicate on the label whether or not the product contains added flame retardant chemicals.

Upholstered furniture sold in California must meet flame retardant standards established by the Bureau of Electronic and Appliance Repair, Home Furnishings and Thermal Insulation. In 2013, in response to studies purportedly linking flame retardant chemicals to adverse health and environmental impacts, the bureau revised those standards. The new standards can be met with or without use of flame retardant chemicals, but existing law did not require manufacturers to disclose whether those chemical were added to their products.

SB 1019 mandates that covered products carry a label indicating whether the product contains added flame retardant chemicals and including the following language:

"The State of California has updated the flammability standard and determined that the fire safety requirements for this product can be met without adding flame retardant chemicals. The state has identified many flame retardant chemicals as being known to, or strongly suspected of, adversely impacting human health or development."

The law also requires manufacturers to maintain documentation, obligates the bureau to ensure compliance with the labeling and documentation requirements, and establishes fines for mislabeling.

In summary, during the 2014 legislative year California considered many bills that would have expanded the scope of liability under existing laws, created new liabilities, and imposed additional burdens on consumer products and services companies. In the end, the bills that survived the rigor of the legislative process are far more limited in scope.