Amends Consumer Privacy Laws
initiative statute
Official Summary
Permits consumers to: prevent businesses from sharing personal information, correct inaccurate personal information, and limit businesses’ use of "sensitive personal information," including precise geolocation, race, ethnicity, and health information. Establishes California Privacy Protection Agency.
Fiscal Impact: Increased annual state costs of at least $10 million, but unlikely exceeding low tens of millions of dollars, to enforce expanded consumer privacy laws. Some costs would be offset by penalties for violating these laws.
support: $5,907,002 - Alastair MacTaggart
oppose: $48,368
Notes
Businesses collect data about consumers from different sources. These include (1) public sources, (2) consumers themselves (such as when consumers create an account), or (3) other businesses (such as by purchasing data).
Under state law, certain businesses that operate in California and collect personal data must meet consumer data privacy requirements. (Personal data include information such as names, Internet or purchase activity, and predictions about consumers.) These businesses generally (1) earn more than $25 million in annual revenue; (2) buy, sell, or share the personal data of 50,000 or more consumers, households, or devices annually; or (3) earn 50 percent or more of their annual revenues from selling personal data.
The ballot initiative would do the following:
changes threshold for a company needing to comply with data privacy requirements, from 50,000 or more consumers, households, or devices annually to 100,000 or more consumers or households.
requires these companies to not share a consumer's personal information upon the consumer's request, including precise geolocation, race, ethnicity, religion, genetic data, private communications, sexual orientation, and specified health information
requires these companies to provide consumers with an opt-out option for having their sensitive personal information, as defined in law, used or disclosed for advertising or marketing;
requires these companies to obtain permission before collecting data from consumers who are younger than 16 and obtain permission from a parent or guardian before collecting data from consumers who are younger than 13
requires these companies to correct a consumer's inaccurate personal information upon the consumer's request
establish California Privacy Protection Agency to additionally enforce and implement consumer privacy laws and impose fines.
triples maximum penalties for violations concerning consumers under age 16, to $7500.
authorizes civil penalties for theft of consumer login information in certain situations
eliminates the ability of businesses to avoid penalties by addressing violations within 30 days of being told of the violation