With voters’ passage of Proposition 24, a new law which will expand consumer data regulation, businesses now have another set of safeguard measures to implement or risk facing civil suits for non-compliance.
“The economic recovery of California businesses took another blow this November 3rd when voters passed Proposition 24,” Kyla Christoffersen Powell, president and CEO of the Civil Justice Association of California (CJAC) told the Northern California Record by email. “This broad and vague statute will further increase the regulatory uncertainty around privacy law obligations at a time when businesses are already grappling with the unpredictability of operating in a pandemic.”
Because the Prop 24 law – the California Privacy Rights Act of 2020 (CPRA) – was approved by a ballot initiative that specifies it can only be toughened – not moderated – by lawmakers, it would take another referendum to roll back its provisions. Among the more concerning is the limitation of a California Consumer Protection Act (CCPA) clause that provides a chance to remedy potential violations before facing penalties.
A CJAC letter asked Prop 24’s chief backer, Alastair Mactaggart of Californians for Consumer Privacy, to forgo another ballot initiative; in 2018, the CCP group had sought a similar referendum, but then worked with state lawmakers to create the CCPA law, which will stand until the CPRA takes effect in January 2023.
The CCPA presented a significant implementation challenge, which the new law escalates, Powell said.
“What many voters may not have realized is that California’s legislature had already passed a sweeping law, the California Consumer Privacy Act [CCPA], which had only started to be enforced in July of this year,” Powell said. “Businesses are still struggling to comply, but with Proposition 24’s passage, they must now grapple with a whole new and different layer of privacy law, as well as a new regulatory agency.”
The California Privacy Protection Agency will be responsible for CPRA implementation and will work with the state Department of Justice on enforcement.
“The expanded compliance hurdles open up businesses to more litigation,” Powell said. “Of particular concern is Prop. 24’s private right of action which allows private plaintiff’s attorneys to sue in the place of state regulators. If this becomes a means for harassing shakedown lawsuits like we have seen occur with other laws, Prop. 24 unfortunately bars any fixes, absent another ballot initiative.”
Additional “No on Prop 24” supporters include the ACLU of California, Consumer Federation of California, Californians for Privacy Now, and the California Small Business Association.