A new state law gives people living in California new ways to protect their data from being collected and sold.
Assembly Bill 375, also called The California Consumer Privacy Act of 2018, passed the legislature in February. Now lawmakers are working out the kinks before it goes into effect on January 1, 2020. The delay is to let companies get into compliance.
"It's the concept of a right to be forgotten," says Justine Phillips, a Cyber Lawyer for the Sheppard Mullin law firm in Downtown San Diego. Phillips also teaches law at the University of San Diego.
"This law clearly empowers Californians to do more about protecting their own data, and gives them some remedies and rights to go after that protection," she says.
According to a websitemanaged by the group Californians for Consumer Privacy, some of the new rights include:
- Right to know all data collected by a business on you.
- Right to say NO to the sale of your information.
- Right to DELETE your data.
- Right to be informed of what categories of data will be collected about you prior to its collection, and to be informed of any changes to this collection.
- Mandated opt-in before the sale of children’s information (under the age of 16).
- Right to know the categories of third parties with whom your data is shared.
- Right to know the categories of sources of information from whom your data was acquired.
- Right to know the business or commercial purpose of collecting your information.
- Enforcement by the Attorney General of the State of California.
- Private right of action when companies breach your data, to make sure these companies keep your information safe.
Phillips says this could force sweeping changes for companies online. One of the biggest will be that websites will now have to have a "Do Not Sell My Information Online" button.
"You'll see websites will look a little bit different, privacy policies will be updated," she says. Phillips also noted that the law could have impacts well beyond California since so many online companies outside the state mainttain data on California residents.
According to the San Diego-based Privacy Rights Clearinghouse, "there’s a lot of work to be done before there are actual regulations on the books, and over the next two years consumer and industry advocates will be submitting recommendations to the Attorney General’s office to guide those regulations."
A spokesperson told 10News they still have concerns about the bill's limitations, especially where it relates to lawsuits and discrimination. In a statement, the spokesperson said, "I don’t think the California Consumer Privacy Act is quite polished enough to serve as model legislation, but it should be appreciated as an acknowledgment “business as usual” when it comes to business’s handling of consumer data is no longer good enough."
