California Lawyers Association Legislative Day – Privacy Law Breakout Session

By Michael Dore

From “scooter bills” to the Suspense File¹, the Privacy Law breakout session during last week’s CLA Legislative Day covered topics showing the full breadth of policy and procedural issues confronting the California Legislature as it wades through a number of new proposed laws related to data privacy. 

Key insiders Nichole Rocha (Chief Consultant for the California Assembly’s Committee on Privacy and Consumer Protection chaired by Assembly Member Ed Chau), Melissa Immel (Deputy Legislative Secretary & Chief of Legislative Operations in the Office of Governor Gavin Newsom), and Ariel Fox Johnson (Senior Counsel, Global Policy at Common Sense Media) each offered insights about the status of current bills and potential changes to California’s data privacy law on the horizon.  They addressed heavily scrutinized legal developments like the staffing of and rulemaking by the new California Privacy Protection Agency, as well as attention-getting bills related to genetic privacy and constitutional speech protections.  Ironically, though, one of the things that stood out the most was the discussion of a proposed law about boats.      

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer the right to direct a business not to sell personal information about the consumer to third parties.  The California Privacy Rights Act (CPRA) also gives consumers an “opt-out” right with respect to sharing of the consumer’s personal information.  Assembly Bill (AB) 335 would exempt from the right to opt out “vessel” information or ownership information retained or shared between a vessel dealer and its manufacturer, if the information is shared to effectuate or in anticipation of effectuating a vessel repair covered by a vessel warranty or a recall. 

In 2019, the Legislature passed, and the Governor signed into law, AB 1146, which established a virtually identical exemption from the CCPA for vehicle information.  AB 335 merely applies this same exemption to watercraft.  But between the passage of AB 1146 (exempting vehicle information from a consumer’s opt-out right) in 2019, and the introduction of AB 335 (exempting vessel information from a consumer’s opt-out right) in 2021, California voters passed Proposition 24, which expanded and clarified privacy rights and obligations under State law and renamed the CCPA as the CPRA. 

The California Constitution prohibits the Legislature from amending a statute created by a ballot proposition unless the initiative (here, Proposition 24) permits amendment or repeal without the electors’ approval.  (Cal. Const. art. II Sec. 10(c)).  Proposition 24 permits legislative amendment, provided that “such amendments are consistent with and further the purpose and intent of this Act as set forth in Section 3 [of Proposition 24], including amendments to the exemptions in Section 1798.145 if the laws upon which the exemptions are based are intended to enhance privacy and are consistent with and further the purposes and intent of this Act ….”  Prop. 24 at Sec. 25(a).  Section 3(c) of the proposition states that, “[t]he law should be amended, if necessary, to improve its operation, provided that the amendments do not compromise or weaken consumer privacy, while giving attention to the impact on business and innovation.”  (Emphasis added.)

As noted during the Privacy Law breakout session, and in the thorough bill analysis by the Assembly Committee on Privacy and Consumer Protection, the exemption for vessels arguably already exists as a matter of federal law.  So any California bill expressly exempting vessel information, just like the 2019 bill expressly exempting vehicle information, could be construed as merely a specific statement of an already existing general exemption.  These laws would not “weaken” consumer privacy through a new exemption, and thus run afoul of Section 3(c) of Proposition 24; they would merely give assurance to vehicle and vessel dealers and manufacturers that they are shielded from CPRA liability where they are complying with federal recall laws.    

Nevertheless, the seemingly mundane AB 335 raises what likely will be an ongoing issue as legislators navigate the restrictions of Proposition 24.  The proposition does not inherently bar every new exemption from the opt-out right.  And what it means to say that an amendment to  the CPRA compromises or weakens customer privacy itself may become a subject of debate.  Either way, as discussed during the Legislative Day breakout sessions, legislators’ willingness to expand the opt-out-right exemptions and their rationale for doing so bear watching, including with respect to personal information that a business collects in the context of an employment relationship.            

Michael Dore is a partner at the law firm Gibson, Dunn & Crutcher LLP and a member of the firm’s Media, Entertainment & Technology Practice Group and its White Collar Defense and Investigations Practice Group. He is a member of the CLA Privacy Section Legislative Committee.

[1]   The Assembly Appropriations Committee sends any bill with an annual cost of more than $150,000 to a Suspense File, after which those bills are considered at a Suspense File hearing to determine if the bill should be released for further consideration.  In the Senate, the criteria for referral to the Suspense File is a cost of $50,000 or more to the General Fund or $150,000 or more to a special fund.