The Need for Improved Legislative Findings in California Privacy Rights Act Bills

Similar to bills proposing to amend the California Political Reform Act, in reviewing recently-introduced legislation that proposes amendments to the California Privacy Rights Act (CPRA), the same legislative finding and declaration is made in each bill. It is a simplistic statement that raises the question whether this language meets the requirement of the CPRA. In addition, it raises concern whether the courts will find such language sufficient to justify an amendment to the CPRA.

The “California Consumer Privacy Act of 2018” was added to the California Civil Code by Chapter 55 (AB 375 – Chau) of the Statutes of 2018. The CCPA was added to Division 3, Part 4, Title 1.81.5 and includes Civil Code Sections 1798.100 – 1798.199.100. In addition, the CCPA was amended by the state’s voters in Proposition 24, which is titled the “California Privacy Rights Act of 2020.”

Prop. 24 expanded and amended the provisions of the CCPA, created the California Privacy Protection Agency, and removed the ability of businesses to fix violations before being penalized for violations, among other provisions. The CPRA has the following major sections:

• General Duties of Businesses that Collect Personal Information
• Consumers’ Right to Delete Personal Information
• Consumers’ Right to Correct Inaccurate Personal Information
• Consumers’ Right to Know What Personal Information is Being Collected. Right to Access Personal Information
• Consumers’ Right to Know What Personal Information is Sold or Shared and to Whom
• Consumers’ Right to Opt Out of Sale or Sharing of Personal Information
• Consumers’ Right to Limit Use and Disclosure of Sensitive Personal Information
• Consumers’ Right of No Retaliation Following Opt Out or Exercise of Other Rights
• Methods of Limiting Sale, Sharing, and Use of Personal Information and Use of Sensitive Personal Information
• Personal Information Security Breaches

Civil Code Section 1798.194 requires Title 1.81.5 to be liberally construed to effectuate its purposes.

Readers will recall that Article II, Section 10 of the California Constitution provides in Subdivision (c):

The Legislature may amend or repeal a referendum statute. The Legislature may amend or repeal an initiative statute by another statute that becomes effective only when approved by the electors unless the initiative statute permits amendment or repeal without the electors’ approval.

This constitutional provision only allows an initiative that was adopted by the state’s voters to be amended by the Legislature (such as Prop. 24) if the initiative permits amendment without the electorate’s approval. The CPRA does allow amendment by the Legislature in Section 25, which is titled “Amendment,” and which reads as follows:

(a) The provisions of this Act may be amended after its approval by the voters by a statute that is passed by a vote of a majority of the members of each house of the Legislature and signed by the Governor, provided that such amendments are consistent with and further the purpose and intent of this Act as set forth in Section 3, including amendments to the exemptions in Section 1798.145 if the laws upon which the exemptions are based are amended to enhance privacy and are consistent with and further the purposes and intent of this Act and amendments to address a decision of a California state or federal court holding that a provision of the Act is unconstitutional or preempted by federal law, provided that any further amendments to legislation that addresses a court holding shall be subject to this subdivision. (Emphasis added in bold type)

As a result, the Legislature may amend the CPRA if “consistent with” and “to further the purpose and intent” of the CPRA. So, when the Legislature desires to amend the CPRA, it includes in a “plus section” (which can be seen at the end of a bill that proposes to amend the CPRA) a legislative finding and declaration. The following is an example of what is contained in almost every CPRA amendment bill:

The Legislature finds and declares that this act furthers the purposes and intent of The California Privacy Rights Act of 2020.

The question to address is whether the language in the above example is sufficient or if there should be some explanation why the Legislature believes the CPRA’s purpose and intent are being furthered by the proposed amendment. In other words, this legislative finding and declaration at the end of the bill should be tied back to the purpose and intent of the CPRA in Section 3.

The following is the extensive language of Section 3 of the CPRA:

SEC. 3. Purpose and Intent. In enacting this act, it is the purpose and intent of the people of the State of California to further protect consumers’ rights, including the constitutional right of privacy. The implementation of this act shall be guided by the following principles:

A. Consumer Rights

1. Consumers should know who is collecting their personal information and that of their children, how it is being used, and to whom it is disclosed so that they have the information necessary to exercise meaningful control over businesses’ use of their personal information and that of their children.

2. Consumers should be able to control the use of their personal information, including limiting the use of their sensitive personal information, the unauthorized use or disclosure of which creates a heightened risk of harm to the consumer, and they should have meaningful options over how it is collected, used, and disclosed.

3. Consumers should have access to their personal information and should be able to correct it, delete it, and take it with them from one business to another.

4. Consumers or their authorized agents should be able to exercise these options through easily accessible self-serve tools.

5. Consumers should be able to exercise these rights without being penalized for doing so.

6. Consumers should be able to hold businesses accountable for failing to take reasonable precautions to protect their most sensitive personal information from hackers and security breaches.

7. Consumers should benefit from businesses’ use of their personal information.

8. The privacy interests of employees and independent contractors should also be protected, taking into account the differences in the relationship between employees or independent contractors and businesses as compared to the relationship between consumers and businesses. In addition, this law is not intended to interfere with the right to organize and collective bargaining under the National Labor Relations Act. It is the purpose and intent of the Act to extend the exemptions in this title for employee and business to business communications until January 1, 2023.

B. Responsibilities of Businesses

1. Businesses should specifically and clearly inform consumers about how they collect and use personal information and how they can exercise their rights and choice.

2. Businesses should only collect consumers’ personal information for specific, explicit, and legitimate disclosed purposes and should not further collect, use, or disclose consumers’ personal information for reasons incompatible with those purposes.

3. Businesses should collect consumers’ personal information only to the extent that it is relevant and limited to what is necessary in relation to the purposes for which it is being collected, used, and shared.

4. Businesses should provide consumers or their authorized agents with easily accessible means to allow consumers and their children to obtain their personal information, to delete it or correct it, to opt out of its sale and sharing across business platforms, services, businesses, and devices, and to limit the use of their sensitive personal information.

5. Businesses should not penalize consumers for exercising these rights.

6. Businesses should take reasonable precautions to protect consumers’ personal information from a security breach.

7. Businesses should be held accountable when they violate consumers’ privacy rights, and the penalties should be higher when the violation affects children.

C. Implementation of the Law

1. The rights of consumers and the responsibilities of businesses should be implemented with the goal of strengthening consumer privacy while giving attention to the impact on business and innovation. Consumer privacy and the development of beneficial new products and services are not necessarily incompatible goals. Strong consumer privacy rights create incentives to innovate and develop new products that are privacy protective.

2. Businesses and consumers should be provided with clear guidance about their responsibilities and rights.

3. The law should place the consumer in a position to knowingly and freely negotiate with a business over the business’ use of the consumer’s personal information.

4. The law should adjust to technological changes, help consumers exercise their rights, and assist businesses with compliance with the continuing goal of strengthening consumer privacy.

5. The law should enable proconsumer new products and services and promote efficiency of implementation for business provided that the amendments do not compromise or weaken consumer privacy.

6. The law should be amended, if necessary, to improve its operation, provided that the amendments do not compromise or weaken consumer privacy, while giving attention to the impact on business and innovation.

7. Businesses should be held accountable for violating the law through vigorous administrative and civil enforcement.

8. To the extent it advances consumer privacy and business compliance, the law should be compatible with privacy laws in other jurisdictions.

Should the bills that propose amendments to the CPRA include reference to any of these findings and declarations or purposes? That is the approach often taken with urgency clauses and special statutes. If courts examine the urgency clause or special statute findings, there is at least a short sentence or paragraph that explains why the Legislature has determined a particular bill needs an urgency clause or why the bill qualifies as a special statute.

As an example, California’s AUMA (allowing the adult use of cannabis) initiative statute similarly allows legislative amendment if those amendments further the purposes of the AUMA. A recently-introduced bill amending the AUMA contains what could be an example for CPRA amendment bills:

The Legislature finds and declares that this act furthers the purposes and intent of the Control, Regulate and Tax Adult Use of Marijuana Act (AUMA) by accomplishing all of the following:

(a) Preventing the illegal diversion of cannabis to other states by providing legal and regulated channels for multistate commercial cannabis activities.

(b) Reducing barriers to entry into the legal, regulated market by providing additional legal outlets for cannabis and cannabis products produced in California.

(c) Ensuring that cannabis and cannabis products produced in other states and sold in this state meet the same testing and packaging requirements required under AUMA.

So, perhaps the bills that propose to amend the CPRA should also provide some rationale for their proposed amendments so that, if the legislation were challenged in litigation, courts would have a basis for understanding why the Legislature determined the bill made an amendment to the CPRA that furthered its purposes. As a result, the Legislature should consider adding some explanatory language to their simple statements in CPRA-amendment bills.

Finally, to assist the courts additionally, the committee and floor analyses prepared by the Assembly and Senate consultants should also describe these legislative findings and declarations and the rationale for them. These actions will hopefully ensure that the judiciary will uphold any amendments to the CPRA enacted by the Legislature and Governor in the future.