New privacy initiative aimed at 2020 ballot costing money and certainty

A new voter initiative designed to improve consumer privacy in California will cost upwards of $10 million a year to enforce, including possibly for higher court costs, according to a new fiscal impact estimate report released this week. But the California Privacy Rights and Enforcement Act of 2020is already costing businesses something as well: certainty.

The new initiative is moving forward as the California Department of Justice is holding a series of four public comment meetings this week on the data privacy law that was signed last year. At the first meeting in Sacramento on Monday, representatives from a variety of business and non-profit groups claimed the state’s new data privacy law — the California Consumer Privacy Act, or CCPA — will be difficult to comply with, even after the attorney general’s office produced a detailed set of regulations. Speakers at a second hearing in Los Angeles made similar comments Tuesday.

The initiative’s sponsor, San Francisco real estate investor Alastair Mactaggart, dropped an earlier initiative effort in a compromise that led to that law, AB 375. He had already invested $3.2 million into that effort but said at the time it was worth it.

His feelings changed after the law was passed, especially after Gov. Gavin Newsom signed several follow-on bills this year. In a November announcement on the website of the organization he founded, Californians for Consumer Privacy, Mactaggart wrote the initiative was needed because technology companies have weakened the law.

“The new ballot initiative has introduced some uncertainty into the conversation for businesses,” said Lindsey L. Tonsager, a partner with Covington & Burling LLP in San Francisco and co-chair of the firm’s artificial intelligence initiative. “There has been a real whiplash throughout the whole process of the CCPA. It was enacted back in 2018, and its already gone through two stages of legislative amendments, and before the ink is even dry in the draft attorney general regulations, we have a whole new ballot initiative that could really start us from scratch all over again.”

Mactaggart announced in September he was going back to the ballot. He has since submitted a revised version of his initiative that would impose far stricter limits on the use of consumer data and make it harder for the Legislature to amend the law, as it did repeatedly this year.

Tonsager said the amendments passed this year were “really very small” and mainly serve to clarify the law. The bills Newsom signed exempt some types of consumer data, such as that gathered as part of someone’s employment, made a distinction between private and publicly available data, and set out how companies must notify consumers of data breaches.

The report released Monday by the attorney general’s office and the legislative analyst’s office found the new initiative would require $10 million annually from the state’s General Fund. Much of this would be to operate the new agency that would be tasked with enforcing the law, the California Privacy Protection Agency, and its five-member board.

These costs could also include reviewing complaints and enforcing penalties. Consumers would gain new rights to correct and bar the sharing of personal data, especially sensitive data like health information or data that could be used to identify a particular person. It would also force an entirely new round of rule making. If businesses see increased costs, the report warned, it may result in lower tax revenues to the state.

“Additionally, state court workload could increase if the measure results in the filing of lawsuits by DOJ for violations of the new requirements of this measure. ... Increased state costs to DOJ and trial courts could reach the low millions of dollars annually,” the report warned.

“Litigation costs also are mitigated when businesses comply with the law,” said Brent Blackaby, cofounder of Confidently.com, a San Francisco-based company that designs software consumers can use to protect their privacy.

Blackaby, who spoke at the hearing in Sacramento on Monday, said the initiative mostly builds on the existing law, rather than superseding it.

“To me, this is a question of balance,” Blackaby said. “Up until now the balance has been completely on the side of business doing whatever they want with the data.”