Major online privacy bill becomes law after whirlwind week

A far-reaching online privacy bill that got next-to-no vetting or legislative debate was signed into law by Gov. Jerry Brown last Thursday – the product of a quickly hammered-out agreement among state legislators, privacy advocates, tech firms and a real estate tycoon whose qualifying of an even more sweeping privacy measure for the November ballot triggered a frenzy of action at the Capitol in the past week.

Assembly Bill 375 – the California Consumer Privacy Act of 2018 – would change the playing field in the relationship between users of some online services and the companies that provide the services. It would allow users to ask companies to delete their personal information and to be informed what information about them that the companies were collecting and selling. It would also allow online consumers to sue over some unauthorized breaches of their information – but only for up to $750.

The San Francisco developer who reportedly spent more than $3 million to gather signatures for his ballot measure told the Sacramento Bee that AB375 – while not as far-reaching as his proposal – was more than good enough. Alastair Mactaggart said he was willing to compromise and gain “certainty” of online privacy reforms rather than take on tech giants in a heavy spending free-for-all in the fall election. He pulled his initiative after AB375 was signed by Gov. Jerry Brown on Thursday afternoon – just before the deadline for its possible withdrawal with the Secretary of State’s Office. Brown’s signing came after the bill won unanimous approval from both the Assembly and Senate.

The process under which a measure that qualified for the ballot could be pulled if proponents were satisfied with the Legislature’s alternative was established in a 2014 state law that was billed as an important refinement to the state’s system of direct democracy. The bill was championed by then-Senate President pro Tem Darrell Steinberg, D-Sacramento.

The most important differences between Mactaggart’s proposal and AB375 is that it gives tech companies more certainty of their own that there would be legal limits on their exposure to damage claims from those using their services.

The bill quickly made it to Brown’s desk despite warning from key players.

Tech lobbyist: At least ‘even worse’ measure is dead

The Internet Association, a lobbying group for tech firms with significant online presence, issued a statement decrying “many problematic provisions” in the bill and “the unprecedented lack of debate or full legislative process.” But the association said it would not “obstruct or block AB375 … because it prevents the even worse ballot initiative from becoming law in California.”

The state Senate Judiciary Committee, which approved AB375 on Tuesday, did so even though chairwoman Hannah-Beth Jackson, D-Santa Barbara, expressed “grave, grave concerns about this legislation” to the San Francisco Chronicle. But she also praised its consumer-friendly elements, which take effect in 2020.

While California, as the nation’s largest and wealthiest state, often finds its policies emulated by other states, it’s not clear if AB375 will be copied in other capitals. Companies like Google, Amazon, Comcast and AT&T have steadily increased lobbying and campaign contributions in many states and may try to get what they consider model online privacy legislation passed elsewhere – so it could in theory compete with California’s version.

However, Facebook voiced its support for the state bill. “While not perfect, we support AB375 and look forward to working with policymakers on an approach that protects consumers and promotes responsible innovation,” a Facebook official told the Sacramento Bee.