AB 375: Cyber privacy rights for consumers

Driven by the continued rise in consumer data breaches and growing privacy concern, California passed an unprecedented digital data privacy law known as the California Consumer Privacy Act, Assembly Bill 375. The CCPA grants consumers more control over, and insight into the spread of their personal information online. The passage of this law has created one of the most significant and comprehensive regulations overseeing the data collection practices of technology companies in the United States. This legislation doesn't become fully operation until 2020. It creates five basic rights for California consumers:

• The right to request information about the types of data a business has collected, categories of sources, business purpose for collecting or selling information, and the categories of third parties with whom the business shares consumer personal information, along with specific information collected about the individual.

• The right to access their personal information in a portable format, to the extent technically feasible, in a readily useable format that allows the consumer to transmit the information to another entity without hindrance.

• A right to delete personal information that a business collected from them. While the right-to-know extends to all information a business collected about a consumer, the right-to-delete extends to just the information a business collected from them.

• A right to opt out of sale of personal information about them. A consumer shall have the right to direct a business that sells personal information to third parties not to sell the consumers' personal information. The third party also has obligations in that it cannot sell personal information about a consumer that has been sold to it by a business unless the consumer has received explicit notice and is provided an opportunity to exercise the right to opt out.

• A right to receive equal service and pricing from a business, even if they exercise their privacy rights under the Act, but with significant exceptions.

The CCPA's enforcement responsibility falls primarily with the California's attorney general. In the event a business fails to remedy the violation within 30 days of notification, it may incur civil penalties of up to $7,500 per violation for intentional violations. The CCPA also provides a private right of action. Under certain circumstances, a consumer may pursue action to recover damages of between $100 and $750 per incident or actual damage, whichever is greater.

The law gravely affects the tech industry and there is without a doubt, many companies who oppose this law. Companies such as Facebook, Twitter and Google, argued that the law's requirements could threaten their established business models and significantly reduce their profits. These companies generate revenue from targeted advertising over internet platforms. Under the new law, they must now allow California residents to delete their data or bring it with them to alternative service providers. This restriction could also extend to internet service providers, which collect web browsing data from their consumers and often use it to generate behavioral profiles to enable digital advertising.