Halfway through the California legislative session this summer, it looked like the tech industry and other corporate interests were easily winning a furious battle to re-shape the state’s highly anticipated data privacy law before it goes into effect in January.

Yeah, not so much.

Most of the big-ticket changes to the California Consumer Privacy Act (CCPA) lawmakers proposed this session either died or were significantly watered down before being sent to Gov. Gavin Newsom (D), frustrating both tech and business interests – who wanted to ease some of the law’s stricter elements – and privacy groups, who wanted to make the law even more restrictive and consumer-friendly.

The handful of change measures that did get through to Newsom include:

AB 25 - Exempts personal information collected from employees and other personnel from the scope of the CCPA, though workers could still sue over certain data breaches

AB 1355 – A B2B measure that exempts until January 1, 2021 personal information businesses gather that relates to an “employee, owner, director, officer, or contractor” of another business and that stems from a business-to-business communication or transaction

AB 874 – An addition of the word “reasonably” to the definition of how “personal information” can be identified to a specific consumer

AB 1146 –Exempts certain vehicle ownership information from the law

AB 1564 – Exempts some businesses from a requirement to provide customers with a toll-free number where they can get information about how their data is being used

AB 1202 – A requirement that data brokers register with the California Attorney General’s office or face a fine

All of which still rings a bit hollow to privacy expert Sheila FitzPatrick of FitzPatrick & Associates in Sacramento, which specializes in data privacy consulting for corporations and governments around the globe.

“I think a lot of the fear mongering from some law firms and consulting firms that said [CCPA] was going to be bigger than the EU’s GDPR [General Data Protection Regulation] fell flat this year,” she says.

Most observers expect lawmakers to keep tinkering even after the law takes effect on January 1, 2020. But they won’t be the only ones. A new ballot measure is already in the works to put before voters several proposals to make things tougher on companies that gather consumer data. All of which comes before the attorney general’s office has even compiled its draft regulations for enforcing the law.

The ballot measure is the brainchild of Alastair Mactaggart, board chair of a group called Californians for Consumer Privacy. Mactaggart also qualified a privacy measure for the 2018 ballot, but pulled it after then-Gov. Jerry Brown (D) brokered a deal between lawmakers, tech companies and privacy advocates that became the CCPA. But in a letter published on the group’s website, Mactaggart said tech companies have since “actively and explicitly prioritized weakening the CCPA,” leading him to developing a new proposal.

That measure, among many things, would empower consumers to block their information from being sold without their expressed permission and bar companies from monetizing data through targeted ads. It would also triple the dollar amount of the fine currently allowable under the CCPA “for breaking the law governing collection and sale of children’s private information and would require opt-in consent to collect data from consumers under the age of 16.” Companies would further be required to disclose how they use consumer data to influence elections.

To keep tabs on all this, the state would create a new oversight authority - the California Privacy Protection Agency – to enforce the law and to provide both companies and consumers with guidance for adhering to the law.

FitzPatrick says she supports Mactaggart’s effort, but has concerns that it has the same basic problem as the CCPA.

“I applaud his effort,” she says. “But it has the same flaw as the CCPA, which is that it still doesn’t address whether organizations even have the right to have your data to begin with. It assumes that individuals have already opted in. The law doesn’t even kick in until they already have your personal data.”

Mactaggart will need to gather 600,000 signatures to get the proposal on the November 2020 ballot. But the CCPA isn’t the only high-profile impending California law to still be so unsettled, nor the only one that voters could be asked to weigh in on.

Newsom has already signed AB 5, legislation that in theory could completely upend the so-called gig economy – millions of workers who are currently classified as independent contractors. The new law codifies an earlier California Supreme Court ruling that imposes a three-part “ABC” test to determine if those workers should instead be classified as employees.

Under that test, for an employer to legally classify a worker as an independent contractor they must be able to prove that the worker is:(A) not controlled by the employer; (B) performs work outside the usual course of the employer’s business; and (C) is already independently established in the work being performed. A fail at any of those three requirements means the workers must be treated as an employee.

The law has been seen by most observers as a direct rebuttal to app-based rideshare services like Uber and Lyft, who many contend intentionally misclassify their drivers to avoid adhering to labor laws that apply to employees but not contractors, such as minimum wage and paid leave mandates. Those companies lobbied fiercely against the law all summer, arguing it would destroy their business model and drive them out of business.

Numerous other industries that use on-demand contract workers are also impacted by the law, from fitness instructors to truck drivers. Trucking interests in particular opposed the bill, with more than 150 circling the Capitol in their trucks and blowing their horns in protest in the days before the bill’s final passage last month.

The bill ultimately was amended to include exemptions for several professions, including doctors, lawyers, insurance brokers, architects, engineers, real estate agents, direct sales people, several professional services (travel agents, human resources professionals, etc.), barbers and manicurists among several others. Newsom last Wednesday also signed AB 170, which exempts newspaper carriers and distributors from the law as well.

But the friction won’t end there. Even in signing the measure, Newsom indicated he would continue to work with business leaders, labor unions and lawmakers to craft amendments to the law when the Legislature returns next January.

The challenge will be a big one. Business interests are clamoring for more professions to receive exemptions, something labor unions – which can legally organize employees but not independent contractors – are sure to resist. All are expected to swarm the Capitol next year seeking to get lawmakers on their side.

Added to the mix will be ongoing resistance from the combined forces of Uber, Lyft and app-based food delivery service DoorDash, which last month pledged to spend $90 million on a referendum or ballot measure to overturn the law.

In the meantime, Uber senior legal officer Tony West said the company has no intention of converting its drivers to employee status, contending that work is “outside the usual course of Uber’s business.” West claims Uber is not a rideshare service at all, but “a technology platform for several different types of digital marketplaces.”

California Assemblymember Lorena Gonzalez (D), who authored AB 5, begs to differ.

In a meeting with reporters shortly after Newsom signed the bill into law, she said West was “full of [expletive],” and that Uber’s attitude was a driving force for amendments to the bill late in the process that allow city attorneys to file claims against companies on their own rather than waiting for workers to do so.

But Diane Mulcahy, an author and Babson College professor who teaches a class on the gig economy, questions whether the new California law will do what its supporters claim it will. She notes that a handful of other states - most notably Massachusetts, which passed the law California based its legislation on - already have an “ABC” law in place, with little additional worker protections to show for it.

“We’ve had a bill like this on the books in Massachusetts for a decade,” she says. “There are still plenty of independent contractors that are working on gig economy platforms, and the law has done very little for them.” 

Whether workers in California will feel the same 10 years from now is still to be determined. 

 -- By RICH EHISEN

 

Over Half of States Consider Consumer Data Privacy Bills in 2019

At least 27 states have considered legislation dealing with the privacy of consumer data, according to the National Conference of State Legislatures. Consumer data privacy bills were enacted in six of those states, while measures are still pending in several others, including California, where multiple bills are awaiting gubernatorial action.