California Soon to Have a Privacy Protection Agency

Proposition 24, adopted by the state’s voters on November 3, creates The California Privacy Rights Act of 2020. As part of Prop. 24, there is being established a California Privacy Protection Agency pursuant to Section 24 of the ballot measure. Specifically, in Section 24.1. Section 1798.199.10 is added to the Civil Code to establish in state government the California Privacy Protection Agency, which is vested with full administrative power, authority, and jurisdiction to implement and enforce the California Consumer Privacy Act of 2018.

In addition, the agency is governed by a five-member board, including the chairperson. The chairperson and one member of the board is appointed by the Governor. The Attorney General, Senate Rules Committee, and Speaker of the Assembly each appoint one member of the board. These appointments are supposed to be made from among Californians with expertise in the areas of privacy, technology, and consumer rights.

Note that the initial appointments to the agency are required to be made within 90 days of the effective date of the act adding this section. We anticipate the effective date of Prop. 24 will be December 17, 2020, which means the initial appointments will be made prior to the middle of March.

Section 24.2 adds Section 1798.199.15 to the Civil Code and provides that members of the agency board are required to:

(a) Have qualifications, experience, and skills, in particular in the areas of privacy and technology, required to perform the duties of the agency and exercise its powers.

(b) Maintain the confidentiality of information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers, except to the extent that disclosure is required by the Public Records Act.

(c) Remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from another.

(d) Refrain from any action incompatible with their duties and engaging in any incompatible occupation, whether gainful or not, during their term.

(e) Have the right of access to all information made available by the agency to the chairperson.

(f) Be precluded, for a period of one year after leaving office, from accepting employment with a business that was subject to an enforcement action or civil action under this title during the member’s tenure or during the five-year period preceding the member’s appointment.

(g) Be precluded for a period of two years after leaving office from acting, for compensation, as an agent or attorney for, or otherwise representing, any other person in a matter pending before the agency if the purpose is to influence an action of the agency.

Section 24.3 adds Section 1798.199.20 to the Civil Code and provides that members of the agency board, including the chairperson, serve at the pleasure of their appointing authority but cannot serve for more than eight consecutive years.

Section 24.4 adds Section 1798.199.25 to the Civil Code and provides that, for each day on which they engage in official duties, members of the agency board are to be compensated at the rate of one hundred dollars ($100), adjusted biennially to reflect changes in the cost of living, and be reimbursed for expenses incurred in performance of their official duties.

Section 24.5 adds Section 1798.199.30 to the Civil Code and provides that the agency board must appoint an executive director who acts in accordance with agency policies and regulations and with applicable law. The agency must appoint and discharge officers, counsel, and employees, consistent with applicable civil service laws, and fix the compensation of employees and prescribe their duties. The agency may contract for services that cannot be provided by its employees.

Section 24.6 adds Section 1798.199.35 to the Civil Code and provides the agency board may delegate authority to the chairperson or the executive director to act in the name of the agency between meetings of the agency, except with respect to resolution of enforcement actions and rulemaking authority.

Section 24.7 adds Section 1798.199.40 to the Civil Code and provides the agency must perform the following functions:

(a) Administer, implement, and enforce through administrative actions this title.

(b) On and after the earlier of July 1, 2021, or within six months of the agency providing the Attorney General with notice that it is prepared to assume rulemaking responsibilities under this title, adopt, amend, and rescind regulations pursuant to Section 1798.185 to carry out the purposes and provisions of the California Consumer Privacy Act of 2018.

(c) Through the implementation of this title, protect the fundamental privacy rights of natural persons with respect to the use of their personal information.

(d) Promote public awareness and understanding of the risks, rules, responsibilities, safeguards, and rights in relation to the collection, use, sale, and disclosure of personal information, including the rights of minors with respect to their own information, and provide a public report summarizing the risk assessments filed with the agency while ensuring that data security is not compromised.

(e) Provide guidance to consumers regarding their rights under this title.

(f) Provide guidance to businesses regarding their duties and responsibilities under this title and appoint a Chief Privacy Auditor to conduct audits of businesses to ensure compliance with this title.

(g) Provide technical assistance and advice to the Legislature, upon request, with respect to privacy related legislation.

(h) Monitor relevant developments relating to the protection of personal information and in particular, the development of information and communication technologies and commercial practices.

(i) Cooperate with other agencies with jurisdiction over privacy laws and with data processing authorities in California, other states, territories, and countries to ensure consistent application of privacy protections.

(j) Establish a mechanism pursuant to which persons doing business in California that do not meet the definition of business may voluntarily certify that they are in compliance with this title, and make a list of those entities available to the public.

(k) Solicit, review, and approve applications for grants to the extent funds are available

(l) Perform all other acts necessary or appropriate in the exercise of its power, authority, and jurisdiction and seek to balance the goals of strengthening consumer privacy while giving attention to the impact on businesses.

This new Agency will be funded with an initial sum of $5 million from the General Fund during the 2020-2021 fiscal year, and then $10 million annually thereafter. And, the five board appointees will be appointed before the end of the first quarter 2021.