Democrats in the California Legislature and a wealthy San Francisco developer on Thursday reached a tentative agreement to enact major new consumer privacy rules in exchange for the withdrawal of a measure privacy activists were poised to get on the November ballot.
The deal is contingent on the legislation passing both houses and getting signed by Gov. Jerry Brown at lightning speed. The ballot’s final lineup must be set on June 28.
A trio of activists — San Francisco real estate developer Alastair Mactaggart, former CIA analyst Mary Ross and finance industry executive Rick Arney — have been gathering voter signatures to get a sweeping measure on the ballot that would give California residents more control over their online data. The ballot measure — called the California Consumer Privacy Act of 2018 — would have allowed customers to ask businesses to reveal the personal information it gathers on them and block the businesses from selling the information.
The agreement calls for combining consumer protections that did not appear in the ballot measure with a concession to business groups that means most violations of the law would be enforced by the state attorney general. An exception would be made for any data breach in which the state declined to take a company to court. In those cases, consumers could sue.
Mactaggart called the proposed legislation “substantially similar to our initiative” in a statement. “It gives more privacy protection in some areas, and less in others,” he said.
“This legislation, like the initiative, would provide simple, powerful rights to Californians: Tell me what you know about me. Stop selling it. Keep it safe.”
The compromise legislation, which was released on Thursday night, would allow some information sharing between companies that would have been banned under the initiative. It would also give consumers the right to have their data deleted and ban companies from selling data on users under 16 years old.
A debate over privacy has been simmering since President Trump last year signed a repeal of federal rules that limited what broadband providers can do with customer data. California legislation to make those protections a state law was shelved last September amid heavy lobbying by the telecom industry.
For weeks, the initiative campaign’s backers have promoted their message with videos that show the types of intimate data that companies can collect, such as a person’s exact location, medical history and preferred online shopping times. Mactaggart poured more than $3 million of his own money into the effort to gather signatures for the initiative.
Supporters say the issue has garnered increased attention since federal officials opened an investigation into how data firm Cambridge Analytica accessed the personal information of tens of millions of Facebook users without their knowledge to help elect Trump.
“This is probably one of the most dynamic areas of public policy,” said state Sen. Bob Hertzberg (D-Van Nuys), who helped broker the deal along with Assemblyman Ed Chau (D-Arcadia). “And these issues are only going to get more complex.”
California isn’t alone in considering new privacy protections: Europe began rolling out new sweeping privacy regulations in May that gave customers the right to know what information is gathered about them and how long it is stored. The legislative compromises, said legislative sources, mirrors some of the European rules.
Silicon Valley opponents had called the ballot measure too broad and unworkable. Facebook, Google, AT&T, Verizon and Comcast each contributed at least $200,000 to oppose it. Eight more business groups and trade associations, including the California Bankers Assn. and the Consumer Technology Assn., joined last month.