Proposition 24 would weaken consumer data privacy
Proposition 24, Digital privacy is once again in the crosshairs of the unholy alliance between big data and government. The Personal Information Law and Agency Initiative of 2020, is on the November ballot. Alastair Mactaggart, the San Francisco real estate developer who filed the initiative, argues that Prop 24 would advance privacy rights. Other proponents concede that it is not ideal, but say the initiative would improve online privacy. Despite their optimistic views, the massive 52-page ballot measure would not improve digital privacy and instead it would create huge exemptions and a new state bureaucracy.
Few states protect individual privacy better than California. California is in the minority of states that constitutionally guarantee an explicit right of privacy. In regards to municipal surveillance and other high-tech privacy issues, California again leads the nation in crafting policies on such issues as cell phone surveillance and facial recognition.
California became one of the first states to adopt a consumer privacy protection law with the California Consumer Privacy Act of 2018 (CCPA). But the CCPA was a poor attempt. It imposed overbroad requirements on companies with vague language on what is allowed to be collected from consumers, with little beneficial impact on digital privacy. One of the few positive features of the CCPA is that the information collected from consumers must be disclosed and consumers can request companies to delete their data, which borrows heavily from the “right to be forgotten” principle enshrined in the European Union’s General Data Protection Regulation.
The CCPA did not go into effect until this year, but immediately many people viewed it as window dressing. In the wake of CCPA’s passage, State Senate Majority Leader Bob Hertzberg (D-District 18) was already advocating for a ballot initiative to amend the CCPA. But Prop 24 is not the answer. It would leave Californians in a worse position.
Prop 24 would create huge exceptions for key classes of sensitive information. Real consumer privacy should especially protect consumers from companies handing off their personal data to the government. But Prop 24 adds an additional 90 days, for a total of 180 days, for law enforcement agencies to direct businesses to retain collected data for investigative purposes, prior to obtaining a warrant or subpoena. A California State Auditor report recommended that sensitive information be subject to stricter retention policies, referencing that the California Highway Patrol is required to clear information like license plate numbers after 60 days. Prolonged data retention periods are associated with serious civil liberties concerns, including chilling First Amendment activities.
Also, Prop 24 creates exemptions for certain consumer data requirements, including vehicle ownership information shared by dealers and manufacturers, credit standing, personal job application information, emergency contact information, and student’s grades and educational scores held for education agencies. The Proposition also weakens the right to be forgotten feature of the CCPA. Sec. 125(d)(2) expands a business’ reasons for refusal to include a business’ own “security and integrity”, while Sec. 105(c)(1) limits a business’ responsibility to relay deletion requests to the third parties it shared consumer’s data with.
To enforce these provisions, the ballot initiative would create the California Privacy Protection Agency, a $10 million per year state agency to oversee compliance. While there is currently a bottleneck associated with the State Attorney General’s Office enforcing the CCPA, Prop 24 should have instead created a private right of action, allowing people to sue businesses that mishandle their data, as proposed in the federal Consumer Online Privacy Rights Act.
Until these, and other, problems are fixed, the CCPA and Prop 24 are half measures that reinforce the unholy alliance between Big Data and government, leaving the civil liberties of individuals in jeopardy. Bureaucratic hurdles for businesses are not a substitute for proper data collection standards. We need “do not track” browser features for consumers, opt-in standards where consumers consent to data collection, stronger biometric privacy for sensitive information like personal DNA, and a private right of action against bad actors. For these reasons, voters should oppose Proposition 24. It is paperwork and bureaucracy, not true privacy protection for all Californians.
(Originally published in the Orange County Register )
