THE MORNING EVERYONE LIKE TO GET
STARTED.
I LIKE TO START BY WELCOMING ALL
OF YOU TO OUR NEW LEGISLATIVE
SESSION AND ASSEMBLY PRIVACY AND
CONSUMER PROTECTION COMMITTEES
INFORMATIONAL HEARING.
ON THE CALIFORNIA CONSUMER
PRIVACY ACT OF TWENTY EIGHTEEN
WAS CCPA FOR SHORT.
LET ME ALSO BEGIN BY THANKING
ALL OF THE PANELISTS --
FOR YOUR ATTENDANCE AND
PARTICIPATION HERE TODAY.
I KNOW THAT MANY OF YOU HAVE
CHANGED YOUR BUSY SCHEDULES TO
JOIN US --
AND WE TRULY AND GREATLY
APPRECIATE IT DOWN.
I ALSO WANT TO THANK MY FELLOW
MEMBERS WHO ARE HERE TODAY.
AND EVERYONE HERE IN ATTENDANCE
OR TUNING IN ON THIS VERY
IMPORTANT AND TIMELY TOPIC.
LAST YEAR I HAD THE GREAT
FORTUNE OF WORKING CLOSELY WITH
MY COLLEAGUE SO SENATORS
PITTSBURGH AND DOT ON AB. THREE
SEVENTY FIVE TO FIND A SOLUTION
TO A PROBLEM THAT HAS GIVEN ME
GREAT CONCERN FOR QUITE SOME
TIME.
I EAT DATA PRIVACY.
A BIG PART OF THE REASON WE WERE
ABLE TO REACH DOT.
LEGISLATIVE SOLUTION WAS BECAUSE
OF THE EFFORTS OF A MISTER
ALISTAIR MAKE THAGARD WHO'S HERE
TODAY.
AND THE WHO HAD A PRIVACY
INITIATIVE FOR SINCE
CONSIDERATION ON A TWENTY
EIGHTEEN BALLOT.
ON THE SAME SUBJECT MATTER.
AND TOGETHER WITH THE THE
VALUABLE INPUT OF MANY OTHER
STAKEHOLDERS WE WERE ABLE TO
ENACT THE CALIFORNIA CONSUMER
PRIVACY ACT.
A WHICH HAS BEEN DESCRIBED AS
THE MOST COMPREHENSIVE PRIVACY
RIGHTS LAW IN THE NATION.
I FELT DAN AND I STILL FEEL NOW
THAT AT ITS CORE THE CCPA IS
PREMISED ON A RELATIVELY SIMPLE
CONCEPT.
IT IS BASED ON THE PRINCIPLE
THAT PEOPLE SHOULD HAVE THE
RIGHT TO CONTROL OF THEIR OWN
PERSONAL DATA.
AND SHOULD NOT BE DISCRIMINATED
AGAINST FOR EXERCISING THAT
RIGHT.
IF THE BUSINESS ONCE COLLECT
INFORMATION ABOUT YOU WHILE
SERVING ALL THE WAY UP.
AND THEN USE IT FOR REASONS OF
THEY'RE ALL.
LIKE PROVIDING A SERVICE OR SELL
SHOULD ASK YOUR PERMISSION FIRST.
BECAUSE IT IS YOUR DATA YOUR
PRIVACY IT'S YOUR CHOICE.
SINCE THE PASSAGE OF THE PC CPA
ON JUNE TWENTY EIGHT WE HAVE
TURNED TO CLEAN UP AND
ENFORCEMENT EFFORTS.
WITH THE HELP OF THE SPEAKER THE
ASSEMBLY WAS ABLE TO OBTAIN AN
ADDITIONAL SEVEN HUNDRED
THOUSAND DOLLARS FOR ENFORCEMENT
EFFORTS.
BY THE ATTORNEY GENERAL.
OF COURSE RECOGNIZING THAT
ADDITIONAL FUNDING WILL BE
NEEDED INTO THE FUTURE I AM
COMMITTED TO CONTINUING TO WORK
ON THIS ISSUE THROUGH LEADERSHIP.
WITH MY COLLEAGUES IN BOTH
HOUSES.
AND SEPARATELY BY THE END OF
TWENTY EIGHTEEN WITH THE PASSAGE
OF SB.
ELEVEN TWENTY ONE WE WERE ABLE
TO DRESS DRAFTING ERRORS AND
BRING CLARITY TO THE LAW WITH
RESPECT TO THE FINANCIAL
INDUSTRY.
NEWSPAPERS AND VARIOUS CONCERNS
RAISED BY THE ATTORNEY GENERAL.
THAT BEING SAID BASED ON
CONVERSATION OF OUR TEAM HAS HAD
WITH BOTH BUSINESS AND PRIVACY
GROUPS.
A SINCE THE PASSAGE OF THE LAW
IT IS CLEAR TO ME THAT OUR WORK
IS NOT DONE YET.
THIS HEARING TODAY IS IN
RECOGNITION OF THAT VERY FACT.
I KNOW FIRST BEFORE WE DO
ANYTHING ELSE IT IS CRITICAL
THAT WE MAKE SURE THAT
CALIFORNIANS.
BUSINESSES LEGISLATIVE STAFF IN
INCOMING LEGISLATORS HAVE A
STRONG UNDERSTANDING OF THE
RIGHTS AND PROTECTIONS THAT WE
WANT FOR CALIFORNIANS LAST YEAR.
AS WELL AS THE OBLIGATIONS THAT
IS C. C. P. A. IMPOSES FOR
BUSINESSES.
ONCE WE HAVE DONE THAT IS IT IS
JUST AS CRITICAL THAT WE
CONTINUE OUR WORK TO ENSURE THAT
THE LAW IS RE FINE TRUE TO OUR
INTENT.
SO THAT THE PRIVACY PROTECTIONS
WE FOUGHT AVAILABLE FOR
CONSUMERS AND ALSO THAT
BUSINESSES ARE ABLE TO CARRY OUT
THE LAW AND PRACTICE.
IT IS EASY TO FALL INTO THE TRAP
OF TALKING ABOUT THESE ISSUES --
WOOD BUSINESS AND TECH ON ONE
SIDE AND CONSUMER AND PRIVACY
GROUPS ON THE OTHER BUT I HOPE
WE CAN AVOID THE TYPES OF THESE
TYPES OF PRE JUDGMENTS.
ALL WHILE I'M SURE WE CAN FIND
AREAS OF DISAGREEMENT ON WHAT
NEEDS TO BE DONE.
I'M VERY CONFIDENT THAT THERE IS
PLENTY OF COMMON GROUND TO STAND
ON AND HOLD FOR CONSENSUS
BUILDING INTO THE NEAR FUTURE.
MY GOAL FOR THIS HEARING IS TO
DELVE INTO SOME OF THE ISSUES
THAT MY OFFICE AND LIKELY MANY
OF OUR YOUR OFFICES HAVE BEEN
HEARING ABOUT OVER THE LAST FEW
MONTHS.
AND TO UNCOVER COMMON GROUNDS
FOR ADDITIONAL WORK THAT MAY
EXIST.
AND WERE THE NEXT BIG POLICY
QUESTIONS AND CHALLENGES --
MIGHT LIE.
THIS IS OF PARTICULAR IMPORTANCE --
TO THIS COMMITTEE BECAUSE I
ANTICIPATE WE WILL BE SEEING A
BIT MORE CCPA.
CLEAN UP ALL LEGISLATION THIS
YEAR.
AS CHAIR OF THIS COMMITTEE I
WANT TO MAKE IT KNOWN AS EARLY
AS POSSIBLE THAT I EXPECT TO
AUTHORS AND STAKEHOLDERS TO WORK
COLLECTIVELY AND BILL AS MUCH
CONSENSUS AS POSSIBLE.
ON ANY OF THE ISSUES THAT BRING
THAT THEY BRING BEFORE THE
COMMITTEE.
IN OBVIOUSLY IT'S MY HOPE THAT
FOLKS WILL.
ALL THE IMPORTANT RIGHTS THAT WE
HAVE ESTABLISHED FOR
CALIFORNIANS IN THE NAME OF
CLEAN UP WILL CLARITY.
WE MUST SAFEGUARD THOSE RIGHTS
AND I WILL LOOK TO MEMBERS OF
THIS COMMITTEE TO JOIN ME IN
THAT ARE.
FOR I BELIEVE THAT IF WE WORK
TOGETHER AND WORKED DILIGENTLY.
MORE OFTEN THAN NOT THERE WILL
BE WORKABLE SOLUTIONS THAT ARE
SURGICAL SIZE AND DO NOT ROLL
BACK TO RIGHTS AND PROTECTIONS
THAT'S DALGLISH BY CCPA.
AND I'M ALSO HOPEFUL THAT THE
CONVERSATIONS TODAY CAN SERVE AS
A STEP IN THOSE.
EFFORTS TO FIND COMMONALITY FOR
FUTURE WORK AND TO IDENTIFY
ISSUES THAT DO NOT YET WARRANT
LEGISLATION.
WITHOUT I LOOK FOR TO OUR
DISCUSSION HERE TODAY.
AND TURNED OUT TO MY FELLOW
MEMBERS FOR ANY OPENING REMARKS
THAT THEY LIKE TO MAKE AT THIS
POINT THANK YOU.
MR OBERNOLTE GO AHEAD PLEASE.
THANK YOU MISTER CHAIR I'M VERY
PROUD THAT THE EFFORT TO PASS A
CCPA LAST YEAR WAS BOTH A
BICAMERAL EFFORT ANY BI PARTISAN
EFFORT.
WE WERE FORCED TO DO SO ON A
VERY ABBREVIATED TIME FRAME AND
THEREFORE WE KNEW THAT THE
LEGISLATION WAS GONNA REQUIRE A
SUBSTANTIAL AMOUNT OF CLEAN UP
AND SO THAT'S WHAT THIS EFFORT
IS GOING TO BE FOCUSED ON THIS
YEAR -- BUT
I'M LOOKING FORWARD TO WORKING
THROUGH THE ISSUES I THINK IT'S
GOING TO BE NOT A MONTHS LONG
EFFORT BUT A YEARS LONG EFFORT --
TO CLAR WAY THROUGH THIS VERY
COMPLICATED POLICY FIELD BUT I'M
CONFIDENT THAT WE'RE SOME
PERSEVERANCE AND US SOME HARD
WORK WE'RE GONNA BE ABLE TO DO
IT.
AND I'M LOOKING FORWARD TO
WORKING WITH MY COLLEAGUES IN
BOTH CHAMBERS ON BOTH SIDES OF
THE AISLE TO GET THAT DONE.
THANK YOU VERY MUCH --
AT THIS TIME --
LET ME WELCOME THE REST OF MY
COLLEAGUES --
TO THIS --
HEARING TODAY --
WE ALSO --
MEMBERS --
ASSEMBLYMEMBERS BUFFY WAKES AND
ASSEMBLY MEMBER --
AND SMITH ADJOINING AS A WELCOME
TO OUR COMMUNITY.
SO IF THERE ARE NO ADDITIONAL
COMMENTS FROM THE MEMBERS LET'S
START WITH OUR FIRST PANEL.
AND I LIKE TO RESERVE ALL THE
QUESTIONS AT THE END OF EACH
PANEL.
ARM NOW THOUGH I LIKE TO WELCOME
OUR FIRST PANELIST WHO ARE HERE
TO PROVIDE A FOUNDATIONAL
UNDERSTANDING OF THE C. C. P. A.
N. THE G. D. P. R..
WE HAVE WITH US TODAY FOUR
PANELISTS OFFICE OF ALL MISTER
ALISTAIR MACTAGGART WHO'S THE
CHAIRMAN OF CALIFORNIANS FOR
CONSUMER PRIVACY.
ALL WE ALSO HAVE MISTER JAMES
HARRIS AN ATTORNEY WITH THE RAM
COAL -- TO
HANSON IN PURCELL --
WE ALSO HAVE A RUNNING COME OUT
REAL CHIEF PRIVACY OFFICER WITH
SQUARE AND TANYA FOR SHE PARTNER
AND PRIVACY AND DATA SECURITY
GROUP CHAIR.
FRANK FOR DARKER KNIT CLIENT
INSULTS.
AYE AND FEEL FREE TO CORRECT MY
PRONUNCIATION OF YOUR NAME SO SO
WITH WE'LL START WITH MR
MCTAGGART WELCOME MISTER
MCTAGGART.
THANK YOU MISTER MEMBERS OF THE
COMMITTEE --
MY NAME'S ULTIMATE TAGGER I COME
TO YOU IS THE CHAIRMAN OF
CALIFORNIANS FOR CONSUMER
PRIVACY.
I COME TO YOU WE'LL GO OVER --
THEY COME TO YOU --
AS A PERSON BUT THE BALLOT
MEASURE TOGETHER --
LAST YEAR THE RESULT IN THE
PASSAGE OF THE CALIFORNIA
CONSUMER PRIVACY ACT. ONE THANK
YOU FOR THIS OPPORTUNITY IT'S A
GREAT HONOR TO BE HERE AND SPEAK
IN FRONT OF YOU SO THANK YOU
VERY MUCH THIS TIME.
WHEN I FIRST GOT INVOLVED PEOPLE
ASK ME WHY WHY WAS TWENTY SO
MUCH TIME ON THIS AND THEY SAID
YOU KNOW?
WHY SHOULD I BE INTERESTED WHY
SHOULD I CARE ABOUT THIS?
AND MY POINT IS THIS TECHNOLOGY
IS EXPLODING AND IT'S PERVASIVE.
AND WITHOUT GOING INTO DETAIL
WITH THE TWENTIES TECHNOLOGIES
IT BECOMES APPARENT THAT WE ARE
LIVING IN A WORLD WHERE WORKING
CONSTANTLY MONITORED TRACKED.
JUST THINK OF CARS THEY KNOW
WHAT TIME TO GET TO WORK WHAT
TIME YOU LEAVE WORK THEN HOW
MUCH YOU WEIGH.
KNOW HOW OFTEN YOU GO TO A FAST
FOOD RESTAURANT OR TO THE GYM
AND HOW LONG YOU STAY THERE.
THIS INFORMATION IS VALUABLE HAS
IMPLICATIONS FOR YOUR HEALTH
INSURANCE FOR LIFE INSURANCE.
WE LIVE IN AN ERA OF COMMERCIAL
SURVEILLANCE AND BUT I LIKE TO
SAY.
YOU KNOW STANDARD WILL WITH THE
MOST POWERFUL CORPORATION IN ITS
DAY BUT IT DIDN'T KNOW
EVERYTHING ABOUT YOU.
AND SO I WANT TO TRY TO DO
SOMETHING ABOUT IT WOULD LEAD ME
TO INITIATIVE.
DESPITE ALL THE COMMENTARY THAT
THAT THIS WAS. TO PLACE IN IN A
VERY SHORT REPEATED TIMES ACTUAL
ARCHITECTURE.
THE THE LAW TO TAKE PLACE
QUICKLY BUT THE ARCHITECTURE TO
TWO AND A HALF YEARS OF RESEARCH
OF ME GOING AROUND --
AND THAT LED US TO THE
INITIATIVE WHICH MISTER HARRISON --
DRAFTED MANY TIMES IT OVER AND
OVER AGAIN AND WE ENDED UP
GETTING OUR SIGNATURES IT
BEGINNING OF TWENTY EIGHTEEN FUN
FACT WE ENDED UP WITH MORE
CALIFORNIANS SIGNING THE
PETITION.
THAN LIVE WITH PEOPLE LIVING IN
VERMONT --
WYOMING --
AND WHAT WE GOT OUR FIGURES --
SIGNATURES --
IN -- MAY I
WAS CONTACTED BY THE MEMBERS
LEGISLATURE UP YOUR CHAIR WORK
WITH BOTH OF THEM CLOSELY.
AND FOR MAY AND JUNE SPEND
ENORMOUS AMOUNT OF TIME --
HERE IN NEGOTIATING WITH THEM.
AND THEY'RE BUILT THAT
ULTIMATELY RESULTED IN THE
CALIFORNIA SUMMER PRIVACY ACTORS
HE PICTURES OF BOTH MEMBERS
INTRODUCING IN THE RESPECTIVE
HOUSES.
AND OF COMMENT THAT IT WAS A BY
CAROL BIPARTISAN ISSUE AT ONE OF
THE PROBLEMS IN MY LIFE IS
SEEING THAT THIS PASS OUT OF
BOTH HOUSES UNANIMOUSLY.
DID AGAIN IN AUGUST AND WILL
SOME OF SAID LOOK I WAS JUST
BECAUSE THE LEGISLATURE WAS
TRYING TO GET INITIATIVE OFF THE
BALLOT.
I ALSO THINK THAT IT'S BECAUSE
LEGISLATORS ARE SMART AND
UNDERSTAND WHEN ISSUE HAS
ARRIVED.
AND THEY WANT TO BE ON THE RIGHT
SIDE OF HISTORY ON THIS VOTE --
SO WHAT DOES HE SHOULD BE I
ACTUALLY DID.
I I ONE OF THREE MAIN THINGS FOR
IT TO DO THE FIRST WAS I WANT TO
FIND OUT WHAT COMPANIES KNEW
ABOUT ME WHAT KIND OF
INFORMATION EIGHT HOW CAN I GET
THAT.
THAT -- THAT
INFORMATION SO WE CALL THAT THE
RIGHT TO KNOW.
THE SECOND IS.
I WANT TO BE ABLE TO TELL NOT TO
SELL THIS INFORMATION THE
COMPANY THEY NEVER HEARD OF
AROUND THE WORLD WHICH HAPPENS
RIGHT NOW AND SO.
THIS IS THE RIGHT TO SAY NO.
AND THEN THE THIRD IS LOOKING
GONNA CLICK MY INFORMATION FOR
GONNA SAY KEEP IT SAFE --
DON'T MAKE ME A VICTIM OF
IDENTITY THEFT AND SO THAT WAS
THE RIGHT TO HAVE YOUR
COMMISSION KEPT SECURE.
SO WHO'S COVERED --
FOR US IT'S ONLY IT'S ONLY LARGE
BUSINESSES A LOT OF YOUR
INFORMATION WE DIDN'T THINK THE
PROBLEM WAS WITH MOM AND POPS
WITH NON PROFITS WITH GOVERNMENT
SO WE WE WHICH REALLY ONLY
COVERING.
THAT LIMITED SUBSET.
IN TERMS OF HOW WE APPROACH IT.
SO YOU'VE ALL HEARD OF THE
EUROPEAN UNION THE D. P. R.
WHICH CAME INTO EFFECT --
LAST YEAR ANOTHER PRIVACY LAW.
THEY RELY WHAT'S CALLED NOTICE
AND CONSENT AND THAT IS --
A WITH A WITH A WHERE THEY HAVE
TO GET YOUR CONCEPT FOR THE
PROCESS INFORMATION IF YOU'VE
EVER BEEN UP EUROPEAN WEBSITE
YOU SEE A POP UP SAYING YOU KNOW
PRINT THAT A COOKIE COMMITTED IS
NOW.
WE I THINK TAKEN MORE AMERICAN
APPROACH WHICH IS --
WE GIVE PEOPLE A CHOICE.
NOT A REQUIREMENT WE GIVE YOU
THE CHOICE TO OPT OUT OF THE
SALE OF YOUR INFORMATION --
SOME ISSUES WITH NO TO THINK
THAT WHICH I CAN GO TO LATER IF
YOU'D LIKE --
AT OUR CHOICE WE WE WE ENABLE
THAT BY HAVING THE REQUIREMENT
FOR A DO NOT SELL BUTTON ON ON A
WEBSITE FOR YOU JUST CLICK IT IS
THEY DON'T SOME INFORMATION.
MORE IMPORTANTLY AND I'VE TALKED
WEB BROWSING COMPANIES ABOUT
THIS AND THEY SAID THAT THEY
WILL DO THIS --
WE REQUIRE WEBSITES FOR
COMPANIES TO OFFER A THIRD PARTY
OPT OUT.
AND WHAT THAT MEAN IS THAT THAT.
YOU GO TO A WITH WHAT WE THINK'S
GONNA HAPPEN TO WEB BROWSERS
WILL IN FORGET INCIDENT THAT AND
FORGET IT AND THEN EVERY TIME
YOU VISIT ANY WEBSITE IT WILL
SEND THE MESSAGE TO THE WEBSITE
DON'T SELL THIS PERSON'S
INFORMATION.
ANOTHER IMPORTANT PART ABOUT
THAT CITY PA --
WE PERMIT AT THAT THE ACT FROM
ITS ADVERTISING --
WOULDN'T WANT TO KILL INTERNET --
ADVERTISING DOES SUPPORT
INTERNET BUT AT THE SAME TIME WE
IMPOSED IMPORT RESTRICTIONS ON
ADVERTISING.
WHERE WE DON'T PERMIT THAT
RESELLING OF YOUR INFORMATION
RIGHT NOW GENERALLY YOU SEE AN
AD?
YOUR INFORMATION'S BEEN
AUCTIONED OFF IN REAL TIME DID
AND HUNDREDS OF THOUSAND
COMPANIES HAVE SEEN THAT
INFORMATION IN MANY CASES RETAIN
THAT INFORMATION.
SO WE PUT IMPORT RESTRICTIONS ON
WHAT CAN HAPPEN TO THAT
INFORMATION AFTER THE HAS BEEN
PLACED.
WE OFFER ADDITIONAL RIGHT SINCE
HE'S PA THE RIGHT TO DELETE YOUR
INFORMATION NOW THAT'S A YOU AS
AN AMERICAN RIGHT NOT A EUROPEAN
RIGHT SO IT'S NOT THE RIGHT TO
BE FORGOTTEN.
EXISTS IN IN IN EUROPE BUT IT IS
THE RIGHT TO THE INFORMATION
YOU'VE GIVEN THE COMPANY --
YOU'VE DISCLOSURE POSTED YOU CAN
YOU CAN DELETE.
WE INCREASED PROTECTION FOR
CHILDREN --
RIGHT NOW --
FROM THIRTEEN UP TO SIXTEEN THE
COMPANY HAS TO GET THE CHILD'S --
PERMISSION BEFORE CONSULT
INFORMATION THAT'S OFTEN AS
OPPOSED TO OPT OUT.
AND THEN WE SAY PORTLY THAT
COMPANIES CANNOT DISCRIMINATE
AGAINST YOU IF YOU CHOOSE.
PRIVACY SO YOU SAY DON'T SOMEONE
INFORMATION FOUR HUNDRED DOLLAR
A MONTH BILL YOU KNOW FROM YOUR
CELL PHONE COMPANY BECAUSE YOU
CHOOSE NOT TO HAVE YOUR
GEOLOCATION SOLD.
IN TERMS OF ENFORCEMENT --
WE GIVE THE ATTORNEY GENERAL.
THE RIGHT TO ENFORCE MOST OF THE
ACT.
BUT WE DO HAVE A PRIVATE RIGHT
OF ACTION IS CONSUMER FORSMAN
FOR NEGLIGENT DATA REGION THIS
IS IMPORTANT TO TALK ABOUT FOR
FOR A SECOND BECAUSE BY RIGHT
ACTIONS GOT A LOT OF PRESS.
AND YET I DIDN'T WANT TO HAVE A
SITUATION WHERE THE COMPANY'S
DOING ITS BEST.
AND THE RUSSIAN GOVERNMENT HACKS
INTO IT AND THEN THE COMPANY HAS
IT HAS A HUGE ISSUE.
AND SO WE GIVE THIRTY THREE SAFE
HARBORS COULD REFINANCE SET GOOD
BEHAVIOR.
AS A COMPANIES THAT ENCRYPT YOUR
DATA.
THE REDACTOR DATA I MEAN STICK
YOUR NAME OUT OF THE DATA SET
WHERE THAT ACTUALLY JUST OF
REASONABLE SECURITY PROCEDURES
AND PRACTICES IN PLACE DON'T
FACE THE PRIVATE RIGHT OF ACTION
BUT OTHERWISE --
OTHERWISE YOU KNOW WITH THE
COMPANY'S NEGLIGENT WITH YOUR
DATA.
AND THE AND AND I I I HAVE THIS
ANALOGY OF A BANK THAT.
NOT ONLY DOESN'T WALK IT OR
DOESN'T SHUT THE DOOR THOSE
COMPANIES WERE TRYING TO SAY HEY
LOOK YOU GOT TO PAY ATTENTION TO
PEOPLE'S INFORMATION IS
IMPORTANT.
SO WHERE DOES THAT LEAVE US NOW.
I THINK IF YOU LOOK IN IN IN HIS
STARK CIRCLE CONTACT WHERE WE
ARE WITH RESPECT TO PRIVACY.
THINK ABOUT THE NINETEEN FIFTIES
WITH AUTO SAFETY.
THINK WHAT THE NINETEEN SIXTIES
WITH --
SMOKING AND TOBACCO IN THE
RIGHTS FOR THE ANTI SMOKING
PROGRAMS.
THINK ABOUT THE NINETEEN
SEVENTIES WITH AUTO EMISSIONS.
IN EACH CASE SOCIETY
[inaudible]
AND GOVERNMENT.
REALIZE THERE WAS A PROBLEM AND
DEMANDED CHANGE AND SET THE
INDUSTRY LOOK YOU CAN DO BETTER
YOU MUST DO BETTER.
IN MANY CASES INDUSTRY.
VEHEMENTLY RESISTED AT INITIALLY.
AND YET IMAGINE TODAY A WORLD
WHERE.
WE DIDN'T HAVE THESE.
CHANGES HAD BEEN HADN'T HADN'T
HAPPENED WE WOULD BE ABLE SEE
ACROSS LA ON UP.
ON ANY DAY FRANKLY.
AND SO I THINK THAT'S WHERE WE
ARE RIGHT NOW A LOT IT'S BEEN
WRITTEN ABOUT PRIVACY BEING --
REGULATIONS IN THE DEATH OF
INTERNET.
YOU KNOW WHAT.
IT'S NOT ALL THESE COMPANIES ARE
TO DO JUST FINE THERE TO MAKE A
LOT OF MONEY.
BUT WE THE PEOPLE NEED SOME
BASIC RIGHTS WITH RESPECT TO
WHAT'S HAPPENING TO OUR
INFORMATION IS OUR INFORMATION.
I THINK THIS COMMITTEE HAS A
TREMENDOUS RESPONSIBILITY
CALIFORNIA IS NOW A WORLDWIDE
LEADER.
IN.
THE AREA OF PRIVACY AND WE KNOW
THAT DURING THIS NEXT COMING
YEAR -- I
WAS AWARE WHEN I WITHDREW THE
INITIATIVE.
THAT -- THAT
WOULD OPEN THIS UP TO THE
POSSIBILITY OF CHANGE.
BAD AND GOOD I'M WOODS WILL TAKE
THE RISK BECAUSE I SHOULD
BELIEVE ANY INSTITUTION I
BELIEVE YOU GUYS ARE GONNA DO A
GREAT JOB DEFENDING THIS BILL
MAKING SURE THAT WHEN IT GOES
INTO EFFECT NEXT YEAR.
IT'S A GREAT --
BILL FOR CALIFORNIA FOR THE
WORLD THANK YOU SO MUCH THANK
YOU VERY MUCH NEXTEL PANELISTS
PLEASE.
GOOD MORNING I'M RON MORNING
CREW CHIEF PRIVACY OFFICER OF
SQUARE.
THANK YOU MISTER CHAIRMAN FOR
HOLDING THIS HEARING FOR YOUR
EFFORTS TO LEAD ON THE IMPORTANT
ISSUE OF CONSUMER PRIVACY.
AS WE CAN TRASCENDENTALES YOU.
THE E. U.'S GDP ARE TODAY WE AIM
TO HELP YOU UNDERSTAND NOT ONLY
HOW SEE CPA'S IMPLEMENTATION ME
IMPACTED COMPANIES SUCH AS
SQUARE.
BUT MORE IMPORTANTLY HOW IT
MIGHT AFFECT THE MILLIONS OF
SMALL BUSINESSES THAT WE SERVE.
IN WHILE CPA'S IT'S INTENDED TO
REGULATE THEM.
PARTS OF IT FOR EXAMPLE THE
FIFTY THOUSAND DEVICE A YEAR.
BET CAN AND DOES IMPACT MANY
SMALL BUSINESSES ACROSS
CALIFORNIA SO JUST WANT TO NOTE
THAT. FOR EXAMPLE.
A CRITICAL WAY THAT WE
BUSINESSES IS TO PREVENT PRESENT
PREVENTIVE RISK AND FRAUD WHICH
RELIES ON A NUANCED
UNDERSTANDING OF CUSTOMER IN
BUSINESS DATA.
RESPONSIBLE USES OF DATA ARE
ALSO ESSENTIAL TO ALLOW US TO
PROVIDE OTHER CRITICAL SERVICES
FOR SMALL BUSINESSES SUCH AS
HELPING THEM PROCESS PAYMENTS
RUN THEIR BUSINESS PAY AND
PROVIDE BENEFITS TO THEIR
EMPLOYEES.
AND GET ACCESS TO CAPITAL TO
GROW.
GETTING CBA'S IMPLEMENTATION
RATE IS CRITICAL TO PRESERVING
THESE CRUCIAL SERVICES TO SMALL
BUSINESSES.
SO I'LL FOCUS IS GUSHING ON THE
PARTS OF GDP ARE THAT ARE THE
CLOSEST ANALOGUES TO THE NEW
RIGHTS YOU GAVE CALIFORNIANS
UNDERSEA CPA.
SO WHAT IS NEEDED GPR DO FIRST
IT PROTECTS PERSONAL DATA WHICH
IS WHAT THEY CALL PI.
AND IT DEFINES THAT AS DATED
THAT DIRECTLY OR INDIRECTLY
IDENTIFIES A NATURAL PERSON.
THIS PROTECTS STATED THAT
IDENTIFIES PEOPLE WHILE AVOIDING
OVER CAPTURING DATA THAT ARE
MERELY KEEP WILL BEING
ASSOCIATED WITH THEM FOR EXAMPLE
THE GENDER FEMALE IS CAPABLE OF
BEING ASSOCIATED WITH HALF THE
HUMAN POPULATION.
BUT IT DOESN'T IDENTIFY ANY OF
US.
IT ALSO EXCLUDES TO DONNA MISER
DE IDENTIFIED DATA.
BECAUSE IT RECOGNIZES THAT THIS
TYPE OF DATA DOES NOT BUT IT BY
ITSELF IDENTIFY PEOPLE. TO TO PR
IS A DEFINITION ALLOWS THE RULES
THAT FLOW FROM IT. TO PROTECT
PRIVACY AND THE SECURITY OF DATA.
THAT IDENTIFY A PERSON.
REGARDLESS OF THE TECHNOLOGY
INVOLVED.
IT ALSO FOSTERS INNOVATION AND
ECONOMIC GROWTH.
IN YET IT AVOIDS TRAMPLING ON
THE PRIVACY OF OTHERS WHOSE DATA
MAY BE COMMINGLED IN THE SAME
HOUSEHOLD OR DEVICE.
WOW SEE CBA'S INTENDED TO MIRROR
TEACH YOU TO DO G. DEPART P. R.
PRINCIPLES IT COULD BE
MISINTERPRETED TO APPLY TO A
BROADER SET OF DATA THAN YOU
INTENDED. TO AVOID THESE
UNINTENDED CONSEQUENCES IT COULD
BE HELPFUL FOR YOU TO HELP
FURTHER HARMONIZE C. C. P. A.'S
DEFINITION OF PI. TO THE GDP OUR
DEFINITION OF PERSONAL DATA.
SECOND GPR HAS RULES FOR WHEN PI
CAN BE USED.
LIKE CCPA IT STRIKES A BALANCE
BETWEEN PROTECTING PRIVACY AND
GIVING PEOPLE CONTROL OVER THEIR
PI WHILE PERMITTING IT TO BE
USED AND SHARED FOR LEGITIMATE
BUSINESS PURPOSES.
GPR REQUIRES CONSENT WHERE IT
MATTERS MOST FOR EXAMPLE WHEN
THERE IS A SURPRISING OR
UNEXPECTED OR NOT REASONABLY
ANTICIPATED SALE OF YOUR DATA.
JUDY PR DOES NOT HOWEVER REQUIRE
CONSENT WHEN A BUSINESS AND ITS
SERVICE PROVIDERS USE DATA
TRANSPARENTLY FAIRLY AND BASED
ON OTHER LAWFUL REASONS SUCH AS
FOR EXAMPLE TO COMPLY WITH THE
LAW.
ANTI MONEY LAUNDERING BEING A
GOOD EXAMPLE OF IT. TO FILL A
CONTRACT WITH OR TO PROVIDE THIS
IS REQUESTED BY THE CONSUMER.
AND IT IN WAYS THAT ARE
OTHERWISE IN A LEGITIMATE
INTEREST OF THE BUSINESS FOR
EXAMPLE TO RUN A LOYALTY OR
REWARDS PROGRAM TO BENEFIT THEIR
THEIR CUSTOMERS.
YOU TO PEER ARE YOU.
CURTAILS PROBLEMATIC DATA SALES
BUT IT DOESN'T PROVIDE DOES NOT
PROVIDE A RIGHT TO OPT OUT OF
THE TO DISCLOSURES TO SERVICE
PROVIDERS FOR LEGITIMATE
BUSINESS PURPOSES.
WE COMMEND YOU FOR STRIKING A
SIMILARLY THOUGHTFUL BALANCING
CCPA.
THIRD.
GPR GIVES EUROPEAN DATA RIGHTS.
AS ALISTAIR MENTIONED UPON A
VERIFIABLE REQUEST.
EUROPEANS HAVE THE RIGHT TO KNOW
AN AXIS WITH DATA COMPANY HAS ON
THEM HOW IT'S USED AND WHY IN
THE CATEGORIES OF THIRD PARTIES
WITH WHOM IT SHARED.
IT ALSO GIVES THEM THE RIGHT TO
CORRECT INTO PORT TO TAKE THAT
DATA WITH THEM.
IT GIVES THEM THE RIGHT TO
DELETE DATA WHICH JUST LIKE IN
CCPA IS NOT ABSOLUTE.
IT IS SUBJECT TO EXEMPTIONS
CALIBRATED TO PERMIT LEGITIMATE
DATA USES TO CONTINUE.
THIS IS AN IMPORTANT EXEMPTION
[inaudible] FOR EXAMPLE.
IT PREVENTS THINGS LIKE A FRAUD
STIRS STANDING IN A DAY DELETE
ME REQUEST.
THAT IS INTENDED TO WEAKEN THE
COMPANY'S ABILITY TO DETECT
THEIR FRAUDULENT DEEDS.
NOW THIS IS IMPORTANT --
IN ITS BEST TO THE LAST POINT IS
A DIFFERENCE BETWEEN BETWEEN
GPRC CBA BEST ILLUSTRATED BY AN
EXAMPLE.
SO CONTRARY TO MY BET BEST --
IT TOOK TO MY PRIVACY BACKGROUND
I HAVE.
YOU KNOW SUBMITTED MY DNA EIGHT
IF LEARN MORE ABOUT MY ANCESTRY.
THE THOUGHT THAT SOMEBODY COULD
TAKE DATA THAT WAS STOLEN FROM
ME DURING THE EQUIFAX HACK.
INTO DARK NET.
USE THAT DATA TO CALL THE ONE
EIGHT HUNDRED NUMBER TO PRETEND
TO BE ME AND GET A COPY OF MY
GENETIC CODE.
TERRIFIES ME.
G. DPR MITIGATES AGAINST AT RISK.
BY NOT DICTATING THE MEANS FOR
ALLOWING SOMEBODY TO EXERCISE
THEIR RIGHTS.
BUT SIMPLY IT LEAVES IT UP TO
THE BUSINESS TO DETERMINE HOW TO
DO THAT.
IN THE CONTEXT OF HOW THEY
USUALLY INTERACT WITH THE
CUSTOMER WHAT THAT DOES.
IS ALLOW BUSINESSES TO TAKE A
RISK BASED APPROACH TO MAKE SURE.
THAT THEY KIND OF KNOW THE
PERSON WHO'S ACTUALLY TRYING TO
GET A COPY OF THE DATA IS YOU.
WE HOPE YOU FIND THIS
INFORMATION HELPFUL.
PLEASE LET US KNOW IF WE CAN BE
OF ANY FURTHER ASSISTANCE THANK
YOU VERY MUCH AND NEXT PANELIST
PLEASE.
GOOD MORNING MORNING WELCOME.
MISTER CHAIR AND MEMBERS THANK
YOU FOR THIS OPPORTUNITY TO
TESTIFY HERE TODAY.
MY NAME IS TANYA FORESIGHT.
AND I AM A PARTNER WITH THE LAW
FIRM FRANKFORT KERR NECKLINE AND
SELLS CHAIR OF THE FIRM'S
PRIVACY AND DATA SECURITY GROUP
AND I'M BASED IN LOS ANGELES.
I THE TIME AND ALSO AN ADJUNCT
PROFESSOR AT LOYOLA LAW SCHOOL --
I'VE BEEN PRACTICING LAW IN
CALIFORNIA SINCE NINETEEN NINETY
SCENE UPRISING DATA SECURITY LAW
SINCE TWO THOUSAND SIX I AM
CERTIFIED BY THE INTERNATIONAL
ASSOCIATION OF PRIVACY
PROFESSIONALS AS A C. I. P. P.
U. S. AND S. T. I. P. T..
I'M AND I'M HERE TODAY IN MY
CAPACITY AS A PRIVACY LAWYER WHO
HAS REPRESENTED HUNDREDS OF
COMPANIES IN COMPLYING.
WITH PRIVACY AND DATA SECURITY
RELATED MATTERS I AM NOT HERE
REPRESENTING ANY PARTICULAR
CLIENT.
I'M HERE ON THIS PANEL TO
PROVIDE YOU WITH SOME IMPORTANT
BACKGROUND.
ON THE BURDENS AND CHALLENGES
THAT COMPANIES FACE AND
COMPLYING WITH OR ATTEMPTING TO
COMPLY WITH THE EUROPEAN GENERAL
DATA PROTECTION REGULATION THE
GDP ARE THAT WE'VE BEEN HEARING
ABOUT THIS MORNING SO FAR.
SO THE GPR HAS EXTRA TERRITORIAL
APPLICATION UNDER ARTICLE.
THREE SO THAT MEANS THAT
COMPANIES THAT DO BUSINESSES DO
BUSINESS IN CALIFORNIA AND WHO
ARE OFFERING GOODS OR SERVICES
TO INDIVIDUALS WHO ARE LOCATED
IN THE EEO AND THAT'S THE TASK
UNDER GPR IT'S NOT BASED ON
RESIDENCY OR ANYTHING LIKE THAT
WHERE ARE THEY LOCATED.
SO FOR CALIFORNIA BUSINESSES
OFFERING GOODS OR SERVICES TO AN
INDIVIDUAL LOCATED IN THE E. U.
THEY ARE ALREADY TODAY REQUIRED
TO COMPLY WITH THE G. P. R..
AND THEY HAD TAKEN SIGNIFICANT
STEPS TO PREPARE FOR AND COMPLY
WITH THOSE REQUIREMENTS TO
PROTECT CONSUMER PRIVACY.
THEY CALL THEM DATA SUBJECTS
UNDER THE GPR BUT THOSE ARE
CONSUMERS WHEN YOU HEAR TALK
ABOUT DATA SUBJECTS THAT'S WHAT
THAT IS.
SO WHAT DO YOU HAVE TO DO TO
PREPARE INTO COMPLY WITH G. P.
ARE YOU HAVE TO DO A LOT.
YOU HAVE TO DO WHAT'S CALLED
DATA MAPPING OR DATA INVENTORY
IN ORDER KNOW WHAT DATA YOU HAVE
IN THAT IT CANNOT BE FULLY
AUTOMATED YOU HAVE TO TALK TO
EACH OF THE BUSINESS UNITS AND
IT.
AND OBVIOUSLY DEPENDING ON THE
SIZE OF THE COMPANY THAT CAN BE
A FAIRLY SIGNIFICANT UNDERTAKING.
YOU HAVE TO UPDATE ALL YOUR
CONTRACTS WITH YOUR SERVICE
PROVIDERS YOU MUST AND THAT
REQUIRES LEGAL COUNSEL.
YOU MUST UPDATE YOUR PRIVACY
POLICIES THAT ALSO REQUIRES
LEGAL ADVICE.
YOU HAVE TO SET UP AS YOU WERE
HEARING --
FROM PRIOR WITNESSES YOU MUST
SET UP A MECHANISM FOR CONSUMERS
TO EXERCISE THEIR RIGHTS. TO
MAKE REQUESTS DELETE FOR
PORTABILITY --
TO HAVE ACCESS AND TO EXERCISE
THEIR OTHER RIGHTS UNDER THE LAW
AND YOU HAVE TO TRAIN YOUR
PERSONAL.
IF THIS IS DONE CORRECTLY UNDER
THE GPR IT INVOLVES VERY
EXTENSIVE IN SIGNIFICANT
INVESTMENT IN TIME AND RESOURCES.
PERSONNEL I. T. AT SARAH IT
REUIRES EITHER NEW HIRES OR
DIVERTING PERSONNEL AWAY FROM
THERE.
EXISTING PERSON WELL PERSON AWAY
FROM THEIR REGULAR JOBS TO DO.
BUSINESSES IN CALIFORNIA HAVE
ALREADY SPENDS ANYWHERE FROM
TENS OF THOUSANDS TO HUNDREDS OF
THOUSANDS TO MILLIONS OF DOLLARS.
PREPARING FOR THE GED PR AND
COMPLYING WITH IT SINCE IT TOOK
A FACT MAY TWENTY FIFTH --
TWENTY EIGHTEEN ACCORDING TO CSO
MAGAZINE 88% OF COMPANIES SPENT
MORE THAN ONE MILLION DOLLARS --
PREPARING FOR GPR.
THE GDP ARE DOES NOT HAVE A
PRIVATE RIGHT OF ACTION --
IT ALLOWS THE E. REGULATORS WHO
ARE CALLED THE DATA PROTECTION
AUTHORITIES HAVE SLIGHTLY
DIFFERENT NAMES AND EVERY
COUNTRY --
TO ENFORCE IT IT DOES ALLOW A
REPRESENTATIVE ACTION SAY BY AN
ADVOCACY GROUP ON BEHALF OF AN
INDIVIDUAL WHO DOES NOT HAVE
STATUTORY DAMAGES --
THAT ARE AVAILABLE WITHOUT ANY
SHOWING OF HARM.
IT BECAME LAW THE PAIR BECAME
LAW ON APRIL TWENTY SIXTEEN BUT
HE DID NOT --
TAKE A FACT ENFORCEMENT DID NOT
BEGIN UNTIL MAY TWENTY FIFTH
TWENTY EIGHTEEN SO BUSINESSES
HAD MORE THAN TWO YEARS TO START
THE PROCESS AND ACTUALLY EVEN
LONGER BECAUSE THE LEGISLATIVE
PROCESS IN WHICH THE JEEP.
WAS ENACTED TO REPLACE THE OLD
DATA PROTECTION DIRECTIVE WITH
ONGOING FOR MANY YEARS AS WELL.
BUT AT LEAST TWO YEARS. TO
UNDERTAKE THAT EXPENSE AND
BURDEN TO PREPARE --
DESPITE THAT DESPITE THAT MANY
IF NOT MOST U. S. COMPANIES ARE
STILL NOT IN COMPLIANCE WITH THE
GPR.
BECAUSE IT'S SUCH A SIGNIFICANT
UNDERTAKING --
ACCORDING TO A CAP GEMINI I
SURVEY THAT WAS RELEASED ONE
WEEK BEFORE THE EFFECTIVE DATE
IN MAY. 85% OF FIRMS IN EUROPE
S. WE'RE NOT READY TO FULLY
COMPLY WHEN IT TOOK A FACT AND
BY THE END OF THE YEAR ONE IN
FOUR WE'RE STILL NOT.
COMPLY.
CZ PA IS EVEN MORE COMPLEX AND
CHALLENGING FOR REASONS THAT
YOU'RE GOING TO HEAR ABOUT LATER
TODAY. FOR EXAMPLE EVEN
INCLUSION OF THE WORD HOUSEHOLD
IN THE DEFINITION OF PERSONAL
INFORMATION WHICH IS NOT PART OF
THE GT PR CHANGES THE ENTIRE
SCOPE OF COMPLIANCE.
AS A CONSEQUENCE DESPITE HAVING
DONE SIGNIFICANT WORK FOR DUTY
ARE.
COMPANIES DOING BUSINESS IN
CALIFORNIA ARE NOT READY FOR
CCPA.
AS CURRENTLY DRAFTED AND I
SHOULD TAKE COMPANIES ALL
COMPANIES DOING BUSINESS IN
CALIFORNIA NOT JUST COMPANIES IN
CALIFORNIA.
I'M IS CURRENTLY DRAFTED MANY
BUSINESSES WILL HAVE TO REINVENT
THEIR COMPLIANCE PROGRAMS. FORTY
CPA WITH AN EVEN SHORTER TIME
LINE FOR IMPLEMENTATION.
THIS EASY PAY BECAME LAW ON JUNE
TWENTY EIGHTH AS YOU KNOW WAS
ARGUMENT IT ONCE IN SEPTEMBER
AND IT WILL CURRENTLY IS SIDE
TAKE EFFECT JANUARY FIRST.
TWENTY TWENTY SO EXPERIENCE WITH
THE GPR HAS ALREADY DEMONSTRATED
THAT WE ARE GOING TO NEED SOME
CHANGES TO THE C. T. C. TVA AND
TO THE TIMELINE.
IN ORDER FOR COMPLIANCE TO BE
REALISTIC THANK YOU VERY MUCH
THANKS VERY MUCH A NECK SO LET'S --
OPEN IT UP FOR QUESTIONS AND
COMMENTS FROM THE COMMITTEE
MEMBERS [inaudible]
GO AHEAD.
THIS GALLAGHER THANK YOU MISTER
CHAIRMAN AND THANK YOU FOR
HOLDING THIS HEARING --
YOU KNOW I THINK THIS IS VERY
IMPORTANT THAT WE HAVE THESE
DISCUSSIONS AND THAT WE STE
SHE'S IN INVOLVED --
I DO WANT TO SAY YOU KNOW LAST
YEAR WHEN WE PASS THE CPC CPA I
THOUGHT IT WAS A LANDMARK --
THING FOR US TO DO --
MUCH NEEDED PROBABLY OF A LONG
TIME IN COMING --
AND AND I WOULD POINT OUT AS AS
MISTER MCTAGGART POINTED BROUGHT
UP THIS IS THIS WASN'T SOMETHING
THAT -- YOU
KNOW TO COMPLAIN ABOUT THE
PROCESS OF PAY IN ADDITION TO
BEING ON THE BALLOT WELL WE'VE
SEEN THAT HAPPENED SEVERAL TIMES
NOW.
AND IF PEOPLE DON'T LIKE THAT
PROCESS BEING USED IN WE SHOULD
DO SOMETHING ABOUT THAT.
YOU KNOW THAT ALL THE SLEEVE
THAT THEIR HOWEVER THERE WAS A
LOT OF CONVERSATIONS ABOUT THIS
BILL THAT YOU WERE INVOLVED WITH
MISTER CHAIRMAN --
THE REPUBLICAN CAUCUS WAS ALSO
BUT WE HAD BRIEFINGS.
ON THIS LEGISLATION --
IN AS AS MISTER MCTAGGART SAID
TWO AND A HALF YEARS OF RESEARCH
THAT WENT INTO --
THE YOU KNOW THE THE LEGISLATION
ITSELF AND DRAFTING --
YOU KNOW I I DO SEE THAT THERE
MAY BE ISSUES WHERE WE NEED TO
CLARIFY YOU KNOW FOR BUSINESS
AND SO THAT PEOPLE KNOW HOW TO
BE.
COMPLIANT WITH THE LAW BUT I
THINK WE NEED TO BE VERY MUCH ON
GUARD AGAINST IS MAYBE THINGS
THAT AVAIL DOES THAT.
BUT ARE REALLY SEEKING TO TRY
AND UNDERMINE THE SUBSTANTIVE
RIGHTS.
GRANTED BY THE CCPA.
AND SO THAT'S SOMETHING I WANT
TO BE WATCHING VERY CLOSELY --
I THINK THE I JUST FIND IT A
LITTLE BIT OF A STRETCH TO START
TALKING ABOUT THAT THE REAL
CONCERN IS ABOUT FRAUDSTERS
CALLING IN AND TRYING TO GET.
YOUR PERSONAL INFORMATION WHEN A
LOT OF THESE BUSINESSES HAVE SO
MUCH INFORMATION HAVE THINGS IN
PLACE THAT THEY KNOW MORE.
YEAH ABOUT THESE INDIVIDUALS --
THEN MOST PEOPLE WOULD LIKE TO
THINK THEY DO --
AND HAVE GUARDS AND CHECKED
ENSURE THAT THE PERSON IS.
WHO THEY'RE SAYING THEY ARE WHAT
PEOPLE ARE MORE CONCERNED ABOUT
WITH FOR EXAMPLE TWENTY THREE IN
ME AND SENDING IN YOUR DNA?
IS THAT FOR EXAMPLE A
PHARMACEUTICAL COMPANY COMES IN
AND BUYS A LOT OF SHARES IN THE
IN THE COMPANY.
AND THE CONCERN IS OKAY IS THAT
DATA NOW AND FIND OUT ABOUT MY
ANCESTRY BUT NAY FOR SOMETHING
COMPLETELY DIFFERENT --
THAT HAS NOTHING TO DO WITH THE
PERMISSION THAT I GAVE WHEN I
WHEN I VOLUNTARILY GAVE --
THAT DATA AND SO TO ME LIKE WHAT
WHAT WE'RE REALLY TRYING TO GET
AT STE CERTAINLY WE WANT TO
PROTECT AGAINST FRAUD AND IN
PEOPLE ABUSING THE SYSTEM --
FOR SURE BUT I THINK THE BIGGER
CONCERN AND THREAT OUT THERE
FROM THE PUBLIC IS THAT THEIR
DATA IS BEING USED IN WAYS THAT
THEY NEVER GAVE PERMISSION. TO
USE AND IS BEING MONETIZE IN
WAYS THAT THEY NEVER GAVE.
PERMISSION --
AND SO TO ME THAT IS A BIGGER UP
FRONT FUNDAMENTAL UNDERLYING
THING THAT WE WOULD WE WANT TO
ABSOLUTELY PROTECT --
YOU KNOW AS WE ARE AS WE'RE
LOOKING AT THIS AS WE SHOULD WE
SHOULD BE ALWAYS LOOKING AT OUR
LAWS AND SAYING HEY HOW.
HOW DOES THIS REALLY WORK FOR
THE DAY AND AGE THAT WE LIVE IN --
I WOULD SAY THAT ABOUT A WHOLE
HOST TO LAWS HERE IN CALIFORNIA.
BY THE WAY I'M IN I'M IN THE
AGRICULTURE INDUSTRY.
VERY REGULATED INDUSTRY IN THE
STATE.
LOT OF THINGS THAT WE HAVE TO
COMPLY WITH ON ON A DAY TO DAY
BASIS THAT ARE VERY BURDENSOME
I'LL TELL YOU --
AND LARGELY THIS THIS SPACE
THOUGH IT IS REGULATED IS.
HAS NOT BEEN REGULATED IN THE
SAME WAY AND SO I CAN TELL YOU
FROM PEOPLE WHO OPERATE IN
DIFFERENT INDUSTRIES --
IN A WAY IT DOES SEEM LIKE.
THE YOU KNOW --
LOTS OF REGULATION FOR US AND
KIND OF LIKE HEY YOU GUYS GO
AHEAD AND AND KIND OF DO
WHATEVER YOU WANT --
AND TO ME THAT'S WHY CCPA WITH
SO MUCH NEEDED SO THAT HEY WE'RE
YES THIS IS NEW.
YES IT IS PROVIDING A LOT OF
PROSPERITY --
IN IN.
BREAKTHROUGHS THAT EVERYBODY
BENEFITS FROM.
AND AND WE AND WE VERY MUCH NEED
THIS INDUSTRY BUT IN THIS SPACE
WE ALSO.
JUST LIKE WE HAVE AT THE HISTORY
OF DIFFERENT INDUSTRIES THAT
HAVE NEEDED TO DOUBLE REGULATION
TO ENSURE PROTECTIONS FOR
CONSUMERS AND SO.
YOU KNOW AS AS WE'RE WORKING
THROUGH THESE ISSUES MISTER
CHAIRMAN I THINK THOSE SHOULD BE.
YES OF OUR GUIDING PRINCIPLES
AND AGAIN I THANK YOU FOR HOLDEN
HEARING TODAY.
THANK YOU VERY MUCH MISTER
GALLAGHER OTHER ANY ADDITIONAL
CUTS -- YES
GO AHEAD.
THANK YOU.
I WAS NOT HERE LAST YEAR DURING
ALL THESE DISCUSSIONS BUT THEY
SEEMED --
VERY INTERESTING --
MR MAKE TIRED I JUST HAD A
QUESTION FOR YOU --
IN YOUR PURSUIT --
TO PUSH FOR PRIVACY PROTECTIONS
WHICH I THINK IS MUCH NEEDED --
DID YOU EVER CONSIDER PUSHING
FOR MAYBE DID YOU PUSH AND FOR
AN OFTEN AS OPPOSED TO AN OPT
OUT.
THANK YOU --
YES -- WE
DID AND ACTUALLY ORIGINALLY WAS
CRAFTED AS OFTEN VERSUS OPT OUT
THERE THERE TO TURN THE OTHER
NUMBER ISSUES AROUND --
OPT OUT AND OFTEN SO --
DON'T HAVE MUCH TIME TO ONCE
BEEN A BIT BUT ESSENTIALLY --
THERE ARE THE FIRST AMENDMENT
RIGHTS OF CORPORATIONS.
AND THEN THERE'S ALSO THE WHOLE
BODY OF LAW OF RESTRICTING
COMMERCIAL SPEECH WHICH IS A
LOWER THRESHOLD.
SO THERE IS A VERMONT CASE I
MISTER CICERO AND THIS IS PART
OF MY EDUCATION WHEN I WHEN I
GOT --
ADVICE FROM A VERY WELL
RESPECTED --
PRIVACY PROFESSIONAL --
HERE IN THE STATE CHRIS TO
FINAGLE WHO SUGGESTED TO ME THAT
IF WE WENT WELL THOUGHT IN.
WE WOULD PUT THE LAW AT RISK
WITH RESPECT TO THE SUPREME
COURT DECISION --
WHICH WAS A VERMONT --
CASE WHERE THEY RESTRICTED THIS
WHERE WE'RE AT VERMONT PASS A
LAW RESTRICTING THE SALE OF
PHARMACY PRESCRIBER INFORMATION --
TO DRUG MARKETING COMPANIES AND
WHAT TO THE SUPREME COURT CASE
IT'S REACHED RECORD.
CONTRAST THAT WITH THE DO NOT
CALL LEGISLATION WHERE YOU CAN
YOU KNOW SAY DON'T DON'T CALL ME --
THAT ALSO WHAT'S REPORT THAT WAS
HELD TO BE RESTRICTIONS
COMMERCIAL SPEECH AND SO.
THE IDEA THAT YOU MAKE THE
CONSUMER DO SOMETHING HAVE OPT
OUT AS OPPOSED TO JUST HAVE A
BLANKET RESTRICTION ON COMPANIES.
WAS --
ACCORDING TO PRESERVE NAGLE WAS
WITH -- A
CHALLENGE EVENTUALLY AT THE
COURT.
AND I WAS THE ALSO THE MORE WE
THOUGHT ABOUT IT THE MORE IT
SEEMS LIKE.
IN THE EUROPEAN WORLD WITH THE
NOTICE AND CONSENT YOU'VE COUPLE
ISSUES --
ONE YOU GET THREE CONSENT FIFTY
KEEPING HIM THE POP UPS YOU KNOW
WE DON'T KNOW HOW BUT NOW --
SECONDLY IT THERE'S A CHILLING
EFFECT POTENTIALLY ON INNOVATION
IF YOU THINK ABOUT THE FACT THAT
YOU'RE PROBABLY LIKELY TO GIVE
YOUR PERMISSION. TO THE COMPANY
THAT YOU HEARD OF THE FACEBOOK
OR GOOGLE BUT AT A NEW INNOVATOR
A NEW COMPANY NEVER HEARD OF YOU
MIGHT SAY NO YOU CAN'T CLICK MY
INFORMATION.
SO THEIR NUMBER ISSUES AROUND
NOTICING CONSENT THE EUROPEAN
THING AND SO WHERE.
ALSO BECAUSE WE PROVIDE THAT
THIRD PARTY OPT OUT WE THINK
WHAT'S GONNA HAPPEN IS MOST
PEOPLE JUST GONNA SET IT IN
THEIR BROTHER ONCE AND FORGET
JUST ON SOME INFORMATION AND
WILL BE VERY SEAMLESS.
AND WE'LL GIVE YOU SOME RIGHT SO
THE WHEN WOMEN OFTEN THOUGH
PROVIDE MORE PROTECTIONS.
ALSO FOR FOR CHILDREN --
UNDER SIXTY NOW FROM THIRTEEN TO
SIXTEEN BEFORE THIRTY NOW IT'S
GONNA BE SIXTEEN WITH THIS LAW.
IT DOES BY PROTECTIONS ONE OF
THE PROBLEMS AGAIN IS IS --
YOU KNOW WE LIVE IN A DIFFERENT
FRAME DIFFERENT WORLD WITH A
DIFFERENT SET FLAWS --
THAN IN EUROPE AND SO --
I I MY APPROACH AS I WENT
THROUGH THIS WAS TRYING NOT.
TO AND I HAD ALL THE ANSWERS BUT
TO GO TO THE EXPERTS AND CHOOSE
THE PEOPLE YOU TRUST THE MOST
AND THAT THIS APPROACH SEEMED.
FROM THE PEOPLE I TALK TO HAVE
BEEN SAYING THIS FOR THEIR
LIFETIME SO WE DON'T THEIR
WORKING LIKE TIME SEEMS TO BE
THE BEST APPROACH FOR THIS
COUNTRY GIVEN THE FRAMEWORK WE
LIVE IN SO --
THAT'S THAT'S WHEN WE CHOSE OKAY
THANK YOU.
THANKS MUCH MISTER IRWIN.
THANK YOU AND THIS IS AREALLY
IMPORTANT --
DISCUSSION TODAY BECAUSE AS I'VE
SAID BEFORE I YOU KNOW IT IT
CALIFORNIA NEEDS TO LEAD THE
NATION ON THIS BUT WE ALSO MAKE
NEED TO MAKE SURE THAT WE HAVE.
AND UP WITH MODEL LEGISLATION
THAT THE THE REST OF THE COUNTRY
CAN FOLLOW AND AND OF THEIR AT
WHEN I WAS AT THE NATIONAL
LEAGUE OF CITIES --
A NATIONAL CONFERENCE OF STATE
LEGISLATURES OR WAS A BIG
DISCUSSION AS YOU AND I HAVE
TALKED ABOUT ABOUT A FEDERAL
PREEMPTION AND AND I THAT'S WHY
I THINK IT'S VERY IMPORTANT THAT.
THAT GETS IT RIGHT AND MAKE SURE
THAT WE PROTECT THE PRIVACY OF
OF OUR RESIDENTS.
AND AT THE SAME TIME DON'T BRING
EVERYTHING TO A GRINDING HALT SO --
I HAD A COUPLE OF QUESTIONS AND
AND YOU KNOW AND I THINK SOME OF
IT IS JUST GOING TO REQUIRE
CLARIFICATION ALONG THE WAY AND
ONE OF THE THINGS WAS --
THE SLIDE THAT CAME UP EARLY ON
ABOUT THE THREE SAFE HARBORS AND
THERE'S BEEN SOME DISCUSSION
ABOUT.
DOES IT HAVE TO BE ALL THREE OF
THEM OR IS IT EITHER ENCRYPTION
REDACTION OR REASONABLE SECURITY
AND THEN --
MAYBE YOU CAN DESCRIBE TO ME HOW
WE DETERMINE WHAT REASONABLE
SECURITY AS THANK YOU.
SO IT'S IT'S IT'S ANY OF THEM --
IT'S NOT ALL INTENDED TO BE ALL --
THREE AND SO THE EXISTING
CALIFORNIA LAW FROM --
WELL BEFORE TCPA REQUIRED
COMPANIES TO COLLECT YOUR
PERSONAL INFORMATION TO HAVE THE
REASONABLE PRACTICES AND
PROCEDURES IN PLACE TO PROTECT
THE AT THE NAY THE INFORMATION --
IT.
AND SO WE REFERENCE THAT THAT'S
THE AT THE PARK THE PROBLEM
PREVIOUSLY WAS THERE WERE NO
TEETH AND THERE WERE CERTAIN NO
CONSEQUENCES --
YOU KNOW I THINK CANDIDLY THAT
COMPANIES WILL WANT CERTAINTY SO
FIGHT CRYPT LEAST AT THE
THRESHOLD OF DONE.
AND BASICALLY THINK ABOUT A
CHRISTIAN THIS IS OFF THE SHELF
TECHNOLOGY WE'RE NOT TALKING
ABOUT YOU KNOW --
LETTING SOMEONE ON THE MOVE
WE'RE TALKING ABOUT JUST YOU CAN
BE ANYBODY CAN AND SHOULD
ESPECIALLY BIG COMPANIES SHE CAN
AND SHOULD BE ENCRYPTING THE
DATA.
SO THAT IT IS A VERY CHEAP WILL
MEASURE FOR REJECT THE DATA
TAKING THE PEOPLE'S NAMES OUT OF
THE CONSUMERS NAMES AT THE DATA
SAID -- BUT
ALSO --
THERE'S A THIRD OPTION BECAUSE
WE WANT TO REFERENCE EXISTING
CALIFORNIA LAW BUT ANY OF THOSE --
THREE WILL BE OKAY THANK YOU AND
I BY CERTAINLY APPRECIATE YOUR
OPENNESS AND I HOPE THAT WE CAN
CONTINUE.
TO WORK TOGETHER AND THEN I HAVE
ONE OTHER QUESTION AND IS IT --
THIS. FORTY FOUR FOUR YOU TALKED
ABOUT --
INITIALLY 85% OF THE COMPANY'S
WEREN'T READY FOR A G. P. R..
AND NOW IT'S 25% I'D ACTUALLY
HEARD STATISTICS THAT WERE THAT --
THAT WE ONLY HAVE 40% THAT ARE
ACTUALLY OUR GDP ARE COMPLIANT
SO -- IS
THAT IN THE UNITED STATES.
SO THAT FIGURE CAME WAS SUPPOSED
TO COVER BOTH THAT YOU AND THE
US IT WAS FROM I THINK I SAID
CSO MAGAZINE IS WHERE THAT
STATISTIC CAME FROM I MEAN TO BE
PERFECTLY HONEST WITH YOU IN MY
EXPERIENCE.
AS A PRACTITIONER.
I SEE ALMOST NO COMPANIES THAT
ARE WHAT YOU WOULD CALL FULLY
COMPLIANT I ACTUALLY DON'T THINK
THERE'S REALLY SUCH A THING. TO
BE HONEST AS FULLY COMPLIANT AND
I DON'T LIKE IT FOR EXAMPLE WHEN
I SEE --
VENDORS THAT SELL SERVICES
VENDORS ARE TECHNOLOGY VENDORS
THAT COME OUT AND SAY OH WILL
HELP MAKE YOU 1100% GPR
COMPLIANT JUST LIKE I DON'T LIKE
THAT WITH ANY OTHER KIND OF SALE
THAT ALLEGEDLY IS GONNA MAKE YOU
100% COMPLIANT WITH LAW.
IT'S A PROCESS IT'S AN ONGOING
PROCESS IT'S NOT JUST A POINT IN
TIME WHERE YOU CHECK ALL THESE
BOXES AND YOU SAY --
OR DONE THERE ARE SOME STANDARDS
OUT THERE LIKE THAT LIKE THE
PAYMENT CARD INDUSTRY STANDARD --
WHICH IS BEING CRITICIZED QUITE
A LOT BY THOSE IN THE
INFORMATION'S KURT SECURITY
WORLD BECAUSE IT'S A CHECK THE
BOX APPROACH AND IT DOESN'T
ACTUALLY EAN ANYTHING.
YOU CAN CHECK ALL THOSE BOXES
ONE MINUTE AND THEN THE NEXT
MINUTE.
MAYBE DON'T HAVE REASONABLE
SECURITY MORE BECAUSE THE BAD
GUYS ARE IN AGAIN RIGHT.
SIMILARLY WITH JUDY PR --
LET'S TALK ABOUT LIKE THOSE FAKE
REQUESTS FOR INFORMATION WHICH
DO HAPPEN THEY REALLY DO HAPPEN
THERE'S A GREAT ARTICLE THAT IS
OUT THERE WITH THE I. P. ABOUT
FAKE DATA SUBJECT REQUESTS THAT
YOU CAN FIND ON THEIR BLOG --
THIS IS ALREADY HAPPENING UNDER
GPR HOW CAN YOU BE COMPLIANCE IF
WHEN WHEN SOMEBODY COMES TO YOU
AND ALL YOU HAVE IS THEY GIVE
YOU THEIR EMAIL ADDRESS AND SAY.
I WANT ALL THE INFORMATION YOU
HAVE ABOUT ME AND I. P.
ADDRESSES AND IN YOU KNOW
INFORMATION ABOUT WEB BROWSING
BEHAVIORS SUPPOSED TO BE PART OF
THAT.
YOU CAN'T KNOW THAT BASED ON
JUST WHAT SOMEBODY'S EMAIL IS IN
THEY COULD BE USING SOMEONE
ELSE'S EMAIL BUT IF YOU ASK THEM
TO VERIFY.
GIVE ME SOME SORT OF
IDENTIFICATION FIRST OF ALL
YOU'RE ASKING THEM TO GIVE YOU
MORE PERSONAL INFORMATION THAT
YOU DIDN'T WANT IN THE FIRST
PLACE.
AND THAT'S NOT PRIVACY
PROTECTIVE.
SECONDLY THEY DON'T WANT TO GIVE
A TEO DO THAT DON'T ASK THEM FOR
VERIFICATION SO IT IS TRUE WE
ARE SEEN FRAUDULENT FAKE
REQUESTS FOR INFORMATION HOW CAN
ANY COMPANY POSSIBLY BE.
G. P. R. COMPLIANT UNDER THOSE
CIRCUMSTANCES IT'S AN IMPOSSIBLE
BURDEN TO CHEAP SO I HAPPEN TO
BELIEVE THE STATISTICS ARE MUCH
LOWER.
AND THAT MAYBE ONLY THE VERY
LARGEST COMPANIES WITH THE VERY
LARGEST BUDGETS FOR THIS KIND OF
THING HAVE ACHIEVED ANYTHING
CLOSE TO GPR COMPLIANCE --
AND I THINK THE RIGHT TO BE
FORGOTTEN IS SOMETHING THAT'S
PROBLEM AND WE DON'T HAVE THAT
IN CCPA BUT THAT SEEMS LIKE A
FOR MANY COMPANIES IT'S ALMOST
IMPOSSIBLE --
TO TO COMPLY WITH --
AND I SAID I DO NOT THAT'S THE
QUESTION BEFORE I'M NOT CLEAR ON
WHAT IS THE ENFORCEMENT.
MECHANISM IN THE UNITED STATES
FOR GDP ARE RIGHT SO--
THE EUROPEAN REGULATORS AND LIKE
I SAID THERE'S THIS EXTRA
TERRITORIAL APPLICATION
PROVISION.
IN THE GPR THAT ALLOWS THE DATA
PROTECTION AUTHORITIES IN YOUR
IN EUROPE TO TAKE ACTION AGAINST
US COMPANIES.
OR OR AT LEAST ATTEMPT TO TAKE
ACTION AGAINST US COMPANIES THAT
ARE EVEN IF THEY DON'T HAVE
WHAT'S CALLED ESTABLISHMENT IN
EUROPE SO EVEN IF NO OFFICE.
EVEN IF NO PERSONNEL THIS IS
WHAT CHANGED UNDER GPR NOW IF
I'M HERE IN THE U. S. BUT I AM
ACTIVELY OFFERING MY SERVICES TO
PEOPLE IN THE EO.
THEN.
THEY GET ME THEY THEY SAY THEY
CAN PULL ME AND AND THEY CAN
EXERT THEIR AUTHORITY OVER ME
NOW ARE WE GONNA SEE U. S.
COMPANIES FIGHTING THAT FROM A
JURISDICTIONAL PERSPECTIVE.
I WOULD IMAGINE SO AT SOME POINT
ALREADY KNOWS THAT GOOGLE NOW
GOOGLE IS A UNIQUE EXAMPLE AND
BECAUSE THEY THEY PROBABLY DO
HAVE EUROPEAN STATUS WHEN THEY
DO IN FACT HAVE EUROPEAN
ESTABLISHMENT IT'S A LITTLE
pBUT THERE'S BEEN A FIFTY MILLION
DOLLAR FINE FIFTY MILLION EUROS
WITH EVERYONE CALLED ABOUT THAT
FINE ASSESSED AGAINST THEM.
WE'VE SEEN OTHER SITUATIONS
WHERE YOU REGULATORS HAVE KIND
OF WAFFLE A LITTLE BIT ON THIS
SO THERE IS A A A LETTER FROM
THE UK INFORMATION
COMMISSIONER'S OFFICE TO THE
WASHINGTON POST TAKING ISSUE
WITH SOMETHING THEY DID AND
SAYING IT WAS IN VIOLATION OF
GPR BUT THEN SAYING SOMETHING.
LIKE WELL WE CAN'T REALLY DO
ANYTHING ABOUT IT SO I THINK THE
SHORT ANSWER IS.
WE REALLY DON'T KNOW HOW THEY
PLANNED EXERCISE JURISDICTION WE
JUST KNOW THEY CLAIM THEY CAN.
OKAY AND THEN --
I JUST LAST QUESTION.
FOR MS BRO --
OF THE COMPLIANCE ARE YOU YOU
SAID THAT --
HOW COMPLAINT ARE YOU WITH G. P.
ARE YOU HAVE YOU MOVED IN THAT
DIRECTION YOU'RE TALKING ABOUT
SOME OF THE DIFFICULTIES WITH CC?
PA AS OPPOSED TO GDP ARE ARGUES
IS SQUARE [inaudible]
SOMEWHAT COMPLIANCE.
SO YEAH HAPPIER DRESS THAT --
SO WE NOT ALL OF OUR PRODUCTS
ARE AVAILABLE IN EUROPE BUT FOR
THE ONES THAT ARE YES WEWE HAVE
TAKEN STEPS TO COMPLY WHICH ARE
NOT JUST FOR SQUARE.
BUT EQUALLY IMPORTANT TO ALLOW
THE SMALL BUSINESSES THAT WE
SERVE IN EUROPE TO ALSO COMPLY
WITH THE LAW.
OUT WE HAVE A PRODUCT IN PLACE
WHERE FOR EXAMPLE THEY CAN TAKE
IN THE DATA RIGHT ACROSS FROM
THEIR OWN CUSTOMERS AND THEIR
OWN EMPLOYEES --
AND WE HERE --
BUT TO ADDRESS ALSO MISTER
GALLAGHER IS CONCERNED BECAUSE I
JUST WANNA MAKE THIS VERY VERY
CLEAR.
YOU'RE NOT GOING TO HEAR FROM ME
OR FROM SQUARE.
THAT WE WANT YOU TO DILUTE THE
DATA RIGHTS THAT IS NOT OUR
POINT.
IN FACT OUR BUSINESS MODEL IS
PRETTY WELL ALIGNED WITH PRIVACY
AND SECURITY.
WHAT WE WANT TO BE THOUGHTFUL
ABOUT?
IS TO PROTECT THOSE LEADER
RIGHTS JUST AS YOU DO GDP ARE
PROTECTS THOSE STRONGLY.
BUT ALSO MAKE SURE THAT IT'S NOT
HAVING UNINTENDED CONSEQUENCES
LIKE THE EXAMPLE THAT I GAVE
WHERE SOMEBODY CAN MISS USE DATA
THE STOLE FROM ME TO PRETEND TO
BE ME.
AND PRETEND TO EXERCISE THOSE
DATA RIGHTS BECAUSE THIS.
IT'S ONE OF THE THINGS THAT I
WAS MOST ANXIOUS ABOUT WITH JUDY
PR IS TO MITIGATE THE RISK.
THAT GDP ARE AT THE DATA RIGHTS
WILL BECOME AN ATTACK VECTOR TO
GET YOUR DATA WITHOUT HAVING TO
HACK SOMEONE.
ALRIGHT AND THEN --
MISTER THAGARD SAID THAT HE
WANTED TO AVOID SOME OF THE
ISSUES WITH SMALLER COMPANIES
AND AND HE HAD THE THE LIMIT OF
THE FIFTY THOUSAND RECORDS AND
YOU TOOK ISSUE WITH.
WHAT IS THE REASON OUT OR
DEVICES SO FOR EXAMPLE THAT'S
PER YEAR?
SO IF YOU HAVE A WEBSITE YOU'RE
AN ARTIST YOU HAVE A WEBSITE.
YOU YOU TECHNICALLY CAN HAVE
FIFTY THOUSAND I. P. ADDRESSES
HIT YOU IN A YEAR PRETTY EASILY
THAT'S EIGHT HUNDRED THIRTY
SEVEN PER DAY.
OR SOMETHING LIKE THAT MY MATH
POINT MAY BE SLIGHTLY OFF BUT WE
BELIEVE THAT IT DOES
ENCOMPASSING CAPTURE A LOT OF
SMALL BUSINESSES THAT WE WEREN'T
MEANT TO BE PART OF THIS WHICH
IS WHY WE WANT TO MAKE SURE THAT.
WHEN WE'RE LOOKING A COMPLY WERE
ALSO EMPOWERING OUR SELLERS WHO
DO GET CAPTURED WITHIN CITY PA
TO ALSO COMPLY WITH THE LAW?
MISS RETIRED YOU HAVE A WELL I'D
LIKE TO ADDRESS THIS WHOLE
CONCEPT OF FRAUD AND THE SPECTER
OF FEAR THAT IT RAISES SO. FOR
OUR RIGHT OF ACCESS AND FOR A
RITE OF POLLUTION THERE ONLY
SUBJECT --
AFTER YOU HAVE A VERIFIABLE
CONSUMER REQUEST THAT WE
EXPLICITLY GIVE THE ATTORNEY
GENERAL STATE OF CALIFORNIA
BECAUSE WE DIDN'T WANT TO SET
SOMETHING IN STONE NOW THAT
WOULD BE OUT OF DATE THREE OR
FOUR YEARS.
WE GIVE THIS TRAIN GENERAL THE
RIGHT TO SET RULES ABOUT WHAT A
VERIFIABLE CONSUMER REQUEST IS
AND WE SPECIFICALLY SAY.
THE YOU THE COMPANY DON'T HAVE
TO DELETE.
YOU DON'T HAVE TO GIVE ACCESS IF
YOU CAN'T DETERMINE THAT IT IS
THE CUSTOMER YOU'RE TALKING
ABOUT SO ALL THIS TALK ABOUT
FRAUD.
IS.
IS FRANKLY FEARS SAYING LIKE --
BECAUSE SOMETHING MIGHT HAPPEN
WE CAN'T GIVE PEOPLE ACCESS TO
THEIR INFORMATION.
BUT OUR IN OUR PROPOSED RULES TO
THE ATTORNEY GENERAL TO TURN IT
ON RIGHT NOW TO THE OWN
DISCRETION CAM RELIEF --
ESTABLISH THAT IT IS THE
CONSUMER TALK ABOUT WE'RE NOT
INTERESTED IN FRAUD BUT THE IDEA
THAT BECAUSE SOMETHING MIGHT
HAPPEN WE SHOULD THEREFORE NOT
DO IT I THINK IT'S A LITTLE
SPEECHES.
AND SO WE'RE TRYING TO BE
THOUGHTFUL ABOUT THIS.
WEEK WE'VE GIVEN RULE WRITING
RESPONSIBILITY TO THE TRAIN
GENERAL SO THE TRAIN GENERAL CAN
CHANGE WITH THE TIMES BECAUSE
THIS IS AN IMPORTANT THING.
CLEARLY WE DON'T WANT TO CREATE
A MASSIVE FACTOR FOR FRAUD.
BUT JUST BECAUSE SOMETHING MIGHT
HAPPEN DOESN'T MEAN WE SHOULDN'T
ALSO GIVE PEOPLE CONTROL OVER
THE INFORMATION SO WE'RE TRYING
TO STRIKE A BALANCE --
FOR APPROACH AND WE WORK SO YOU
KNOW SELF CENTERED TO THINK THAT
WE HAVE THE ANSWER WE WANT TO
GIVE THAT TO THE TREE GENERAL
AND THAT'S WHAT THEY'RE DOING
RIGHT NOW.
AND THEN WE WERE GONNA DRESS THE
FIFTY THOUSAND RECORDS.
SO AS PART OF THIS IS A LITTLE
OUT OF TALK ABOUT --
YOU KNOW IF I'M LIKE BALK AT THE
HUNDRED THREE SEVEN VISITORS A
DAY WELL JUST YOUR I. P. ADDRESS
ALONE IS NOT SUFFICIENT TO ABLE --
TO THE COMPANY TO VERIFY WHO YOU
ARE SO AGAIN IN OUR RULES TO OUR
SUGGEST RULES THE ATTORNEY
GENERAL WE SAID LOOK.
UNLESS YOU THE COMPANY CAN
IDENTIFY WHO PEOPLE OR YOU DON'T
HAVE TO RESPOND TO AN ACCESS
REQUEST SO FEW ALL YOU'RE DOING
IS GETTING MUCH I. P. ADDRESSES.
THEN YOU WON'T HAVE TO HAVE A AN
ACCESS REQUEST BECAUSE YOU CAN.
FOR SURE IDENTIFY WHO SEVEN
PEOPLE'S INFORMATION BUT THE
EIGHT CREDIT CARDS OR EMAILS OR
YOU KNOW YOU REALLY ARE TRYING
TO TRACK THEM THEN.
YEAH THAT SEEMS LIKE A
REASONABLE NUMBER FIFTY THOUSAND
PEOPLE YEAR --
TO TO TO TO BE ABLE TO HAVE TO
COMPLY WITH THE LAW AND ALL I
WOULD SAY THAT YOU KNOW.
THE CHAIRMAN AND AND AND CENTERS
FOR LAST YEAR.
WEEK WE HAD A HIGHER NUMBER A
HUNDRED THOUSAND IN OUR TO SHIP
IT WAS LOWERED TO FIFTY THOUSAND
THE LAW.
I THINK WITH DUE CONSIDERATION
FOR WHAT THE LEGISLATURE ONE AND
SO AGAIN THIS IS WASN'T.
THOUGHT LIKE IT'S ALL ME THAT
THIS WAS THIS IS SOMETHING THAT
THE LEGISLATURE AND THERE WAS
COMPLY WITH THE WITH THE RIGHT
NUMBER.
THANK YOU THANKS VERY MUCH
MISSED BERMAN.
THANK YOU MISTER CHAIRMAN FOR
YOUR LEADERSHIP ON THIS ISSUE --
AND THINKING MR TAGGART FOR
FORGOT FORCING THE ISSUE BUT BUT
IN A GOOD WAY BECAUSE THIS IS
SOMETHING THAT WAS LONG OVERDUE
TO HAVE A SERIOUS CONVERSATION
ABOUT AND DEFINITELY SOMETHING
THAT.
THAT ALL OF OUR CONSTITUENTS IN
RESIDENTS --
ARE BECOMING MORE AND MORE
CONCERNED ABOUT A AND AND YEAH
THIS IS --
YOU THE ACTION THAT WE TOOK LAST
YEAR WAS A GOOD FIRST STEP --
IN IN MAKING SURE THAT WOULD
PROVIDE THEM WITH MORE
PROTECTIONS OVER THEIR DATA.
A LIKE I SAID LAST YEAR --
YOU KNOW THE WALL WHILE THE
PROCESS IS WITH A CHANCE TO
FULLY UNDERSTAND ALL THE
DIFFERENT IMPLICATIONS OF
RAMIFICATIONS OF OF THE LANGUAGE
OF THE LAW --
AND WHILE I STRONGLY A 100%
SUPPORT.
PROVIDING MORE PROTECTIONS IN
MAKING SURE THAT CONSUMERS OF
MORE MORE CONTROL OVER THE DATA
I THINK IT'S IMPORTANT WE WALK
THROUGH THE WHOLE PROCESS AND
MAKE SURE.
ARE THERE THINGS IN HERE THAT
ARE OVERLY ONEROUS ON BUSINESSES
AND NOT ACTUALLY EFFECTIVE IN
TERMS OF TRYING TO ACHIEVE OUR
GOALS -- AND
SO ONE THING THAT I JUST WANT
DIVE INTO A LITTLE BIT WHICH MS
BRING YOU --
MENTIONED IS THIS IDEA OF A ONE
EIGHT HUNDRED NUMBER --
AND YOU SAID WELL WE'RE GIVEN AG
THE AUTHORITY TO DETERMINE THE
REGULATIONS TO TO FIGURE OUT THE
BEST PROCESS BUT IT DOES THE
CURRENT LAW ALSO REQUIRES THAT
EVERY BUSINESS HAVE AN EIGHT
HUNDRED NUMBER.
HOW WOULD YOU DO THAT WITH AN
EIGHT HUNDRED NUMBER I MEAN THAT
WAS SOMEBODY CALLING IN --
I I DON'T UNDERSTAND HOW A
BUSINESS COULD POSSIBLY CONFIRM
THAT SOMEBODY IS WHO THEY SAY
THEY ARE THROUGH THEM CALLING IN
AN EIGHT HUNDRED NUMBER GATE
TELL ME WHAT YOU KNOW EXPLAIN TO
ME A LITTLE BIT MORE ABOUT.
WHY IT WHY THAT STEP WAS
REQUIRED LONG?
SO I THINK THE CONCERN HERE IS
FOR FOLKS WHO DON'T HAVE ACCESS.
TO A COMPUTER NECESSARILY OR
POTENTIALLY DON'T HAVE ACCESS --
TO A DEVICE AND ACTUALLY LOWER
INCOME OR OR OR OR LESS EDUCATED
AND SO THERE'S A IDEA THERE THAT
WE WANT TO BE SENSITIVE TO
PEOPLE ACROSS THE SPECTRUM
CONSUMERS ACROSS THE SPECTRUM.
AND I DO THINK IT'S WHERE THE AG --
AND THIS COMMITTEE FRANKLY AS
YOU AS YOU GO THROUGH IT'S SORT
OF THESE AREAS TO MAKE SURE THAT
THEY ARE APPROPRIATE --
AND AND AGAIN LIKE THAT. ONE OF
THE REASONS I I I I WAS HAPPY TO
PULL THE INITIATIVES BECAUSE I
DO THINK THIS IS THE VENUE --
FOR MAKING CHANGES AND I DO
THINK THAT THIS IS AN AREA THAT
SO COMPLICATED THAT IT WILL NEED
CHANGES SO --
TYPE FOR* THAT THANK YOU.
THANKS VERY MUCH AND IF THERE
ARE NO FURTHER QUESTIONS OR
COMMENTS SO I WANT TO THANK THE
FIRST PANELISTS --
PANEL FOR BEING HERE AND LET'S
MOVE ON TO THE NEXT PANEL --
I LIKE TO NOW WELCOME OUR SECOND
PANEL FROM THE CALIFORNIA
DEPARTMENT OF JUSTICE ARE HERE
TO PROVIDE US WITH A STATUS
UPDATE OF THE ATTORNEY GENERAL'S
REGULATORY PROCESS.
AND ALSO DISCUSSED THE AG'S
POLICY COMMENTS ON THE CCPA.
R. JOINING US HERE TODAY IS MISS --
STACY SHORT SIR WHO IS THE
SUPERVISING DEPUTY ATTORNEY
GENERAL A WITH THE CONSUMER LAW
SECTION PRIVACY UNIT CALIFORNIA
DEPARTMENT OF JUSTICE WELCOME
[inaudible]
GOOD MORNING.
GOOD MORNING MISTER CHAIR AND
MEMBERS OF THE COMMITTEE.
MY NAME IS STACY SHOPS ARE AND I
AM THE SUPERVISING DEPUTY
ATTORNEY GENERAL. FOR THE
CONSUMER LAW SECTIONS PRIVACY
UNIT IN THE OFFICE OF THE
ATTORNEY GENERAL HAVE AIR BASE
THERE.
THANK YOU FOR THE INVITATION TO
PARTICIPATE IN TODAY'S
INFORMATIONAL HEARING.
ON THE CALIFORNIA CONSUMER
PRIVACY ACT WHICH I WILL REFER
TO AS THE CPA.
THE ATTORNEY GENERAL PLEASE
IMPORTANT ROLE IN PROMULGATING
REGULATIONS.
AND ENFORCING THIS NEW CONSUMER
PROTECTION LAW AND WE WELCOME
THE OPPORTUNITY. TO STAY ENGAGED
WITH THE LEGISLATURE AS IT
CONSIDERS MODIFICATIONS TO THE
LAW.
I AM HERE TODAY TO DISCUSS TWO
COMPONENTS OF THE ATTORNEY
GENERAL'S WORK ON THE C. CPI.
FIRST I WILL PROVIDE THE
COMMITTEE WITH AN UPDATE ON OUR
RULE MAKING ACTIVITIES.
SECOND I WANT TO CONVEY SOME
REMAINING POLICY CONCERNS
REGARDING THE CURRENT LANGUAGE
OF THE CCPA.
AS LONG AS OUTLINED IN THE
ATTORNEY GENERAL'S AUGUST TWENTY
SECOND TWENTY TWO THOUSAND
EIGHTEEN LETTER TO THE COMMITTEE
CHAIR CHAO AND TO SENATOR
HERTZBERG.
THE AUTHORS OF AB.
THREE SEVENTY FIVE AS PART OF MY
I ALSO RENEW THE ATTORNEY
GENERAL'S REQUEST FOR RESOURCES
AND FUNDING SO THAT WE CAN MEET
OUR RULE MAKING DEADLINES AND
SUSTAINED VIGOROUS OVERSIGHT.
AND EFFECTIVE ENFORCEMENT OF THE
PRIVACY RIGHTS AFFORDED BY THE
CCPA.
AT THIS TIME I'D LIKE TO TAKE A
MOMENT ON BEHALF OF THE ATTORNEY
GENERAL TO SERRA. TO THANK THE
CHAIR AND SENATOR HERTZBERG FOR
MAKING A COMMITMENT LAST YEAR.
TO HELP DOJ WITH ITS TCPA
FUNDING NEEDS WE THANK THEM.
THE MEMBERS OF THIS COMMITTEE.
THE SPEAKER THE PRO TEM AND THE
LEGISLATURE FOR PROVIDING DOJ
WITH THE TWENTY NINTH TWENTY
EIGHTEEN TWENTY NINETEEN FUNDING.
PURSUANT TO SB ELEVEN TWENTY ONE
OUR OFFICE MUST PROMULGATE CCPA
REGULATIONS BY JULY FIRST.
TWENTY TWENTY IS IMPORTANT TO
NOTE THAT ACTIONS BY THE
LEGISLATURE ON TCPA.
THAT ARE SIGNED INTO LAW BY THE
GOVERNOR DURING THIS SESSION MAY
HAVE AN IMPACT ON OUR ABILITY TO
MEET THIS DEADLINE.
SINCE JANUARY EIGHTH TWENTY
NINETEEN WE HAVE BEEN HOLDING
PUBLIC FORUMS THROUGHOUT THE
STATE AS PART OF OUR PRELIMINARY
ACTIVITIES IN THE RULE MAKING
PROCESS.
WE HAVE HELD SIX FORMS TO DATE.
IN SAN FRANCISCO SAN DIEGO
RIVERSIDE LOS ANGELES SACRAMENTO
IN FRESNO.
AND OUR LAST FORM WILL BE AT
STANFORD UNIVERSITY ON MARCH
FIFTH IN THE AFTERNOON.
EACH FORM FOLLOWS THE SAME
FORMAT.
WE PROVIDE A BRIEF INTRODUCTION
OF OUR OFFICES WORK AN OVERVIEW
OF THE RULE MAKING PROCESS AS
SET FORTH.
IN THE CALIFORNIA ADMINISTRATIVE
PROCEDURES ACT IN VARIOUS WAYS
IN WHICH STAKEHOLDERS AND
CONSUMERS CAN SUBMIT COMMENTS TO
OUR OFFICE FOR CONSIDERATION
DURING THIS PRE RULE MAKING
STAGE.
WE ALSO SPECIFICALLY HIGHLIGHT A
LIST OF SEVEN TOPICS AS THAT
FOURTH IN CIVIL CODE SECTION
SEVENTEEN NINETY EIGHT POINT.
ONE EIGHT FIVE AN ASSET THE
PUBLIC COMMENT ON THESE AREAS
BECAUSE THEY REFLECT WHAT WE ARE
PRIORITIZING WITH REGARD TO OUR
JULY TWENTY TWENTY DEADLINE.
THE SEVEN TOPICS ARE WHETHER THE
REGULATIONS SHOULD ADDRESS ONE
THE CATEGORIES OF PERSONAL
INFORMATION. TO THE DEFINITION
OF UNIQUE IDENTIFIERS.
THREE ANY EXCEPTIONS THAT SHOULD
BE ESTABLISHED TO COMPLY WITH
STATE OR FEDERAL LAW. FOR HOW
CONSUMERS CAN SUBMIT A REQUEST
TO OPT OUT OF THE CELL PERSONAL
INFORMATION AND HOW THE BUSINESS
SHOULD COMPLY WITH THAT OPT OUT
REQUEST. FIVE WHAT TYPE OF
UNIFORM OPT OUT LOGO OR BUTTON
SHOULD BE DEVELOPED TO INFORM
CONSUMERS ABOUT THEIR RIGHT TO
OPT OUT. SIX THE NOTICES IN
INFORMATION THAT BUSINESSES MUST
PROVIDE INCLUDING THOSE RELATED
TO FINANCIAL INCENTIVE OFFERINGS.
AND SEVEN HOW THE CONSUMER OR
THEIR AGENT CAN SUBMIT A REQUEST
FOR INFORMATION. TO A BUSINESS
AND HOW THE BUSINESS REASONABLY
VERIFIES THOSE REQUESTS.
WE THEN OPEN UP THE FORM FOR
ANYONE TO SPEAK.
BECAUSE OUR ROLE AT THIS
PRELIMINARY STAGE IS TO LISTEN
AND SEEK BROAD PUBLIC
PARTICIPATION WE DO NOT PROVIDE
RESPONSES TO THOSE PUBLIC
COMMENTS.
AND WE DO NOT ASK OR ANSWER ANY
SUBSTANTIVE QUESTIONS DURING THE
FORUM.
THE ATTENDANCE AND PARTICIPATION
HAS BURIED AT THE FORMS. FOR
EXAMPLE OUR FIRST FORM IN SAN
FRANCISCO HAD NEARLY TWO HUNDRED
ATTENDEES.
BUT ONLY FOURTEEN SPEAKERS.
THE MORE RECENT FORMS AND LOS
ANGELES IN SACRAMENTO HAVE HAD
MUCH HIGHER SPEAKER
PARTICIPATION.
FEATURING COMMENTS FROM THE AD
TECH INDUSTRY PRIVACY ADVOCATES
CONSUMERS AND SMALL BUSINESS.
WE ENCOURAGE EVERY SPEAKER FORM
ATTENDEE THE GENERAL PUBLIC
INCLUDING YOUR CONSTITUENTS. TO
SUBMIT WRITTEN COMMENTS DIRECTLY
TO US.
THE PUBLIC HAS AN IS CONTINUING
TO SUBMIT THESE COMMENTS TO US
BY EMAIL OR MAIL AND MAY DO SO
UNTIL MARCH EIGHTH. TWENTY
NINETEEN FOR CONSIDERATION
DURING THIS PRELIMINARY PER.
IN ADDITION WE HAVE CREATED
NUMEROUS WAYS FOR THE PUBLIC TO
STAY ENGAGED BY DEDICATING A
PORTION OF OUR WEBSITE TO THE C..
MAINTAINING AN EMAIL
SUBSCRIPTION LIST TO PUBLICIZE
UPCOMING EVENTS AND POSTING ROLE
MAKING MATERIALS AND ALL EVENT
INFORMATION ON OUR WEBSITE.
WE HAVE ALSO EMPHASIZED THAT WE
ARE ONLY AT THE BEGINNING OF OUR
BILL MAKING PROCESS AND THAT THE
PUBLIC WILL CONTINUE TO HAVE
MORE OPPORTUNITIES TO
PARTICIPATE.
WE ANTICIPATE ENTERING THE
FORMAL RULE MAKING PERIOD IN THE
FALL OF TWENTY NINETEEN THE
FORMAL RULE MAKING PROCESS WILL
BEGIN WHEN WE PUBLISH OUR NOTICE
OF PROPOSED REGULATORY ACTION
WHICH WILL INCLUDE AN INITIAL
STATEMENT OF REASONS AND ATTRACT
TAX OF THE REGULATIONS.
THE FORMAL RULE MAKING PROCESS
WILL INCLUDE ADDITIONAL PUBLIC
HEARINGS RECEIPT AND
CONSIDERATION A PUBLIC COMMENTS.
RESPONSES TO THOSE COMMENTS AND
ANY POTENTIAL CHANGES TO THE
TEXT OF THE REGULATIONS.
WE ONCE AGAIN ENCOURAGE YOUR
CONSTITUENTS TO SUBMIT COMMENTS
DURING THIS FORMAL RULE MAKING
THE FINAL STAGE OF FILMMAKING.
ALTHOUGH THE TIMELINE IS TIGHT
WE WILL CONTINUE TO WORK
DILIGENTLY TO MEET THE STATUTORY
DEADLINE OF JULY FIRST.
TWENTY TWENTY THIS LEADS TO THE
SECOND COMPONENT OF MY TESTIMONY.
AS THE ATTORNEY GENERAL SEATED
IN HIS AUGUST TWENTY SECOND TWO
THOUSAND EIGHTEEN LETTER.
PROVIDING CALIFORNIANS WITH
PRIVACY PROTECTION IS CRITICALLY
IMPORTANT NOW MORE THAN EVER.
HOWEVER THIS CCPA AS IT
CURRENTLY APPLIES TO THE
ATTORNEY GENERAL'S OFFICE
PRESENTS UNWORKABLE OBLIGATIONS
AND SERIOUS OPERATIONAL
CHALLENGES.
AS ATTORNEY GENERAL BUT THERE
ARE FURTHERS STRESSED FAILURE TO
CURE THESE IDENTIFIED FLAWS WILL
UNDERMINE CALIFORNIA'S AUTHORITY
TO LAUNCH INSISTING VIGOROUS
OVERSIGHT AND EFFECTIVE
ENFORCEMENT.
OF THE C. CPA'S CRITICAL PRIVACY
WE APPRECIATE THE LEGISLATURE
ADDRESSING SOME OF THESE
CONCERNS LAST YEAR.
BY IT SB ELEVEN TWENTY ONE
HOWEVER THREE IMPORTANT ONE
STILL REMAINS.
FIRST.
THE CCPA ALLOWS ANY BUSINESS AND
THIRD PARTY TO SEEK GUIDANCE
DIRECTLY FROM THE ATTORNEY
GENERAL ON HOW TO COMPLY WITH
THE LAW.
ASKING THE ATTORNEY GENERAL'S
OFFICE TO PROVIDE LEGAL COUNSEL
AT TAXPAYERS EXPENSE DIRECTLY
CONFLICTS WITH OUR
CONSTITUTIONAL OBLIGATION TO
INVESTIGATE AND ENFORCE THE LAW.
AGAINST ENTITIES THAT VIOLATE
THOSE LAWS.
OUR OLIGATION IS TO PROTECT THE
PRIVACY RIGHTS OF THE PEOPLE OF
THE STATE OF CALIFORNIA.
NOT THE BUSINESSES THAT VIOLATE
THESE LOTS.
REQUIRING THE USE OF PUBLIC
FUNDS TO PROVIDE UNLIMITED LEGAL
ADVICE TO PRIVATE PARTIES WOULD
BE UNFAIR AND UNCONSCIONABLE NOT
TO MENTION A WASTE OF VALUABLE
STATE RESOURCES.
SECOND THE CCPA PROVIDES A
BUSINESS WITH THE RIGHT TO CURE
ANY ALLEGED VIOLATION BEFORE
BEING HELD A COT ACCOUNTABLE FOR
BREAKING THE LAW.
THIS WOULD ESSENTIALLY BE A GET
OUT OF JAIL FREE CARD.
BUSINESSES WOULD BE PERMITTED TO
VIOLATE THE LAW EVEN KNOWINGLY
AND THE ATTORNEY GENERAL WOULD
HAVE NO ABILITY TO INITIATE AN
ENFORCEMENT ACTION WITHOUT
GIVING THE BUSINESS NOTICE AND
THE OPPORTUNITY TO CURE THE
VIOLATION.
THIS WOULD NOT ONLY
FUNDAMENTALLY ALTER HOW OUR
OFFICE INVESTIGATES AND
PROSECUTES CORPORATE MISCONDUCT.
BUT IT WOULD DRAMATICALLY HINDER
OUR CONSTITUTIONAL DUTY TO
PROTECT THE RIGHTS OF THE PEOPLE
OF CALIFORNIA.
EVERYDAY WE ARE SEEING COMPANIES
BEING CARELESS WITH CALIFORNIANS
PERSONAL INFORMATION AND DATA.
THIS EASY P. AS RIGHT TO CURE
WOULD ALLOW EVEN THE WORST
OFFENDERS TO RECEIVE A PATH
RATHER THAN ALLOWING THE
ATTORNEY GENERAL TO USES
PROSECUTORIAL DISCRETION
ENFORCING THE LAW.
GIVING BUSINESSES THE
OPPORTUNITY TO HAVE A FIX THAT
TICKET DISADVANTAGES BOTH
CONSUMERS AND HONEST BUSINESSES
THAT ARE PLAYING BY THE RULES.
THIRD.
THIS CPA LACKS A PRIVATE RIGHT
OF ACTION THAT WOULD ALLOW
CALIFORNIANS THE ABILITY TO
ENFORCE THE RULES CONFERRED BY
THIS GROUND BREAKING LAW.
INSTEAD THE ACT INCLUDES ONLY A
LIMITED RIGHT TO SUE YOU IF THE
CONSUMER BECOMES A VICTIM OF A
DATA BREACH.
PRIVATE RIGHT OF ACTION PROVIDE
A CRITICAL ADJUNCT TO GOVERNMENT
ENFORCEMENT AND THE ENSURE THAT
CONSUMERS CAN ASSERT THEIR
RIGHTS AND SEEK APPROPRIATE
REMEDIES.
THE ATTORNEY GENERAL URGES YOU
TO EXPAND THE CZ PA PRIVATE
RIGHT OF ACTION TO INCLUDE
VIOLATIONS OF THE KEY RIGHTS
PROVIDED BY THIS ACT.
FINALLY WE WANT TO ONCE AGAIN
THANK THE CHAIR AND SENATOR
HERTZBERG.
THE SPEAKER THE PRO TEM AND THE
LEGISLATURE FOR PROVIDING DOJ
WITH TWENTY EIGHTEEN TWENTY
NINETEEN FUNDING.
WE ALSO WANT TO THANK GOVERNOR
NEW SOME FOR INCLUDING IN HIS
TWENTY NINETEEN TWENTY TWENTY
BUDGET PROPOSAL THE AMOUNT DOJ
REQUESTED FOR THE ON GOING COSTS
OF THE CCPA IMPLEMENTATION AND
ENFORCEMENT.
WE WOULD ONCE AGAIN APPRECIATE
THE LEGISLATURE SUPPORT FOR THE
AMOUNT AS PROVIDED IN THE
GOVERNOR'S BUDGET.
AT THIS POINT I LOOK FORWARD TO
ANSWERING ANY QUESTIONS ABOUT MY
TESTIMONY TODAY.
WHILE I'M HAPPY TO DISCUSS OUR
RULE MAKING ACTIVITIES THUS FAR
OR THE ATTORNEY GENERAL'S POLICY
CONCERNS BECAUSE WE ARE IN THE
MIDST OF DRAFTING THE
REGULATIONS I CANNOT OPINE ON
THE INTERPRETATION OF THE C. CPA.
OR DIMENSIONAL ENFORCEMENT THANK
YOU.
THANK YOU VERY MUCH FOR THE
UPDATE AS WELL AS FOR CONDUCTING
THE FORMS OF THROUGHOUT THE
STATE.
AND WILL CONTINUE TO WORK WITH
YOUR OFFICE --
ON INCREASING THE THE RESOURCES
AMOUNT OF RESOURCES THAT YOU
GUYS NEED SO WITH THAT ARE THERE
ANY QUESTIONS OR COMMENTS AT
FROM COMMITTEE MEMBERS.
TINA LET ME JUST POSE THE
QUESTION --
REGARDING THE THE FIRST ISSUE
THAT YOU RAISED --
OF THE THREE ARE REGARDING --
BUSINESS GUIDANCE AND A
POTENTIAL CONFLICTS OF INTEREST
ON ISN'T IT TRUE THAT THE OF FOR
LAST YEAR ON A. B. --
FOUR FIFTY YOUR OFFICE ACTUALLY
ISSUE SOME KIND OF ADVISORY
GUIDANCE Là LETTER OR OF
COMMONLY ASKED QUESTIONS OR YOU
KNOW TO GUIDE THE ON HOW TO
COMPLY WITHOUT LAW A. B..
FOR FIFTY I APOLOGIZE I'M NOT
AWARE OF WHAT HE BEFORE FIFTY
IT'S ABOUT --
AND TO THE EXTENT THAT THERE IS.
ADVICE ON HOW TO COMPLY I THINK
WE WERE JUST RENEW OUR POSITION
THAT WE DON'T WANT TO GIVE THAT
TYPE OF OF LEGAL ADVICE TO
COMPANIES REGARDING --
HOW DO HOW DO COMPLY WITH THE
LAW YEAH WE'LL BE HAPPY TO WORK
WITH YOU --
GOING FORWARD BUT I THINK THE
THE BILL IT ESSENTIALLY A BEFORE
FIFTY WAS RELATED --
TO IMMIGRANT WORKERS.
IMMIGRANT WORKER PROTECTION ACT --
WHICH WAS PASSED LAST YEAR.
I'LL I'LL FOLLOW UP WITH YOUR
OFF YES.
I WILL LOOK INTO THAT AT THAT
HE'S ACTUALLY WAS A A YOUR
OFFICE ISSUE THE GUIDANCE LETTER
OR VISOR GUIDED THIS LETTER. TO
YOU KNOW TO THE COMMUNITY AS TO
HOW YOU KNOW OUGHT TO WHAT OUGHT.
TO HAPPEN TO COMPLY WITH THE LAW
ON BUT I'LL BE HAPPY TO PROVIDE
YOU WITH MORE INFORMATION AS WE
GO OKAY THANK YOU THANK YOU.
MISSOURI GO AHEAD.
OF I MIGHT JUST WANT TO CLARIFY
ABOUT -- THE
PEORIA.
I THINK THERE WERE A NUMBER OF
MEMBERS OFF THE BALLOT IS
BECAUSE THERE WAS NO P. R. A..
IT'S NOT JUST THE AG THAT CAN
ENFORCE RIGHT IT'S ALSO --
CITY ATTORNEY'S.
UNDER AB.
THREE SEVENTY FIVE UNDER THE
CITY PA CURRENTLY YES I BELIEVE
THAT ENFORCEMENT IS CENTRALIZED
TO THE ATTORNEY GENERAL ONLY.
OKAY THAT I'VE.
THAT WAS MY UNDERSTAND ABOUT THE
BOOK DEFINITELY FOLLOW UP I'M
SURE YOU WOULD KNOW BEFORE I
WOULD I THOUGHT IT WAS --
CITY ATTORNEYS AND DISTRICT
ATTORNEYS AND THE AG I BELIEVE
THAT IT'S SOLELY LIMITED TO THE
ATTORNEY GENERAL IN TERMS OF
BRINGING ENFORCEMENT ACTION.
OKAY AND THEN THE ADDITIONAL
BUDGET REQUEST THAT YOU'RE THAT
YOU'RE ASKING FOR IS JUST TO
WRITE UP THE REGULATIONS NOT
NECESSARILY THE ADDITIONAL --
MONEY THAT WOULD TAKE IF IF
YOU'RE NOT DOING THE ENFORCEMENT.
THE THE FUNDING REQUEST IS
BECAUSE OF WE HAVE AN ON GOING
AUTHORITY TO WRITE REGULATIONS
THAT ARE DUE BY THE JULY FIRST
TWENTY TWENTY DEADLINE AS WELL
AS THE STATUTE GRANTS --
ON GOING WILL MAKING AUTHORITY
AND FOR PURPOSES OF MAKING SURE
THAT WE CAN HAVE THE ENFORCEMENT --
RESOURCES ONCE A LOT GOES INTO
EFFECT.
OKAY AND THEN --
ON THE FIRST ITEM.
I UNDERSTAND THAT YOU DON'T WANT
TO GIVE BUSINESSES ADVICE THAT I
GUESS IT'S KIND OF FOLLOWING UP
ON ASSEMBLY MEMBER TRAP.
IS THERE GOING TO BE AT LEAST
SOME WRITTEN GUIDELINES ON HOW
BUSINESSES --
SHOULD COMPLY.
AT THIS FROM THE AG AT THIS
POINT THE WAY IT'S WRITTEN IT
PROVIDES ANY BUSINESS OR ANY
BUSINESS OR THIRD PARTY TO SEEK
GUIDANCE OR TO ASK FOR LEGAL
ADVICE ESSENTIALLY ON HOW TO
COMPLY.
I THINK THAT PROVIDING THE
ATTORNEY GENERAL WITH --
BUT THE ABILITY.
TO PROVIDE GENERAL GUIDANCE
COULD BE SOMETHING THAT FOR
EXAMPLE WOULD BE PART OF THE
INITIAL STATEMENT OF REASONS --
BUT REQUIRING THAT WE RESPOND TO
ANY BUSINESS EVEN GLOBALLY WOULD
BE -- FAR
TOO BROAD IN TERMS OF OUR
OBLIGATIONS FOR ENFORCING THE
LAW.
THAT.
EIGHT EIGHT I GUESS I DIDN'T
QUITE UNDERSTAND WHERE.
YOU YOU WOULD ISSUE SOME AT
LEAST WRITTEN GUIDELINES ON HOW
BUSINESSES SHOULD COMPLY OR YOU
MIGHT DO THAT.
I'M I'M I HAVE WE HAVEN'T SAT
DOWN AND AND DETERMINED THAT
JUST YET --
AND I'S SOMETHING WE CAN
CONSIDER DOING BUT AT THIS POINT
THE WAY THE STATUTES WRITTEN.
IT IT IS FAR TOO BROAD.
OKAY THANK YOU.
A PICTURE MUCH FOR BEING HERE --
AND WILL FOLLOW UP WITH YOUR
OFFICE -- AS
WE GO FORWARD YES THANK YOU
THANKS AGAIN FOR BEING HERE. TO
THAT BRINGS US TO OUR THIRD
PANEL -- I
LIKE TO WALK HIM I WAS THIRD
PANEL SPEAKERS WHO WILL BE
DISCUSSING THE C. CPA'S
WORKABILITY AND CLARITY ISSUES.
OF JOINING US HERE TODAY WE HOW
FAR CEREBRAL IT FROM THE
CALIFORNIA CHAMBER OF COMMERCE.
ARE EREKLE MAN WHO IS A
PROFESSOR OF LAW FROM KEVIN
MCKINLEY WITH THE INTERNET
ASSOCIATION TONYA FORESIGHT ALL
WHO IS A PARTNER.
IN PRIVACY DATE IN SECURITY
GROUP CHAIR HOMA WE HEARD FROM.
OUR MARGARET LAST WITH THE
RETAILERS ASSOCIATION ELIZABETH
ON AUG GALAXIA --
WILL VICE PRESIDENT OF COMMON
SENSE KIDS ACTION ALISTAIR MATAK
GROUP WHO IS THE CHAIRMAN OF
CALIFORNIANS FOR CONSUMER
PRIVACY WELCOME.
ALL OF YOU TO OUR HEARING A LET
US BEGIN WITH MISS --
BOOED WELCOMES MISSED IT.
IT IS A SIGN OKAY --
I WOULD BEFORE SERRA UT --
ON BEHALF OF THE CALIFORNIA
CHAMBER OF COMMERCE BEFORE I GET
STARTED MY PLAN TESTIMONY FOR
THIS PANEL WOULD IT BE OKAY FOR
ME THAT MAKE A FEW COMMENTS IN
RESPONSE TO THE AG'S TESTIMONY
ABSOLUTELY.
FREE SO MUCH --
I JUST WANT TO FIRST THANK
STACEY SHASTA AND HER TEAM FOR
CREATING MULTIPLE OPPORTUNITIES
FOR PARTICIPATION IN PUBLIC
FORUMS AND FOR MAKING IT CLEAR
THAT THEY PLAN TO REVIEW ALL OF
THE DETAILED.
WRITTEN COMMENTS SUBMITTED TO
THEM DURING THIS INFORMAL PERIOD
THE PROCESS FEELS VERY OPEN
MINDED AND INCLUSIVE AND WE
REALLY APPRECIATE THAT.
SPEAKING ON BEHALF OF THE
BUSINESS COMMUNITY WE APPRECIATE
UNDERSTAND A DAUNTING TASK THE
AG'S OFFICE SPACES TO DRAFT
REGULATIONS AND TO ENFORCE THE
CZ P. AND THEIR CONCERN OVER
LACK OF APPROPRIATE RESOURCES.
AS A STATE WE HAVE DECIDED THE
LEGISLATURE HAS DECIDED THAT
PRIVACY IS WORTH INVESTING IN
LEGISLATURE'S ASK CALIFORNIA
BUSINESSES TO MAKE SIGNIFICANT
INVESTMENTS IN PRIVACY.
YOU ALREADY HEARD FROM TANYA
FORESIGHT THE BUSINESSES ARE
SPENDING A FORTUNE TO COMPLY
WITH THE GT PR WE CAN CERTAINLY
EXPECT THE SAME TO HAPPEN HERE
WITH THE CPA.
WE'VE ALREADY ASKED BUSINESSES
TO INVEST AGREED IT NEEDS TO
INVEST TO AND THAT MEANS GETTING
ADEQUATE RESOURCES TO THE AG.
BUT AS WE THINK THROUGH HOW TO
ALLOCATE THAT INVESTMENT WE HAVE
TO ASK OURSELVES WHAT IS THE
GOAL OF THE CZ PA.
IS IT FOR LAWSUITS AN ATTORNEY'S
FEES AS A FOREIGN FORSMAN
ACTIONS OBVIOUSLY WE HOPE NOT --
THE GOAL SHOULD BE COMPLIANCE
AND THAT MEANS THAT A STATE
INVESTMENT OF RESOURCES FOR THE
AG TO PROVIDE ADVISORY OPINIONS
TO BUSINESSES ON HOW TO COMPLY
WITH THIS COMPLEX AND CONFUSING
Là WOULD BE MONEY WELL SPENT.
A STATE INVESTMENT OF RESOURCES
TO ENSURE THAT BUSINESSES HAVE
THE OPPORTUNITY IF NEEDED TO
CURE THEIR APPROACH TO
IMPLEMENTING THE PRACTICES AND
PROCEDURES OF THE CCPA WOULD BE
MONEY WELL SPENT.
AND FRANKLY THESE KINDS OF
EDUCATIONAL APPROACHES ARE GONNA
BE FAR MORE EFFICIENT USE OF
RESOURCES AND COSTLY ENFORCEMENT
ACTIONS.
AND AS FOR THE P. R. A. THE IDEA
THAT WE'RE WE WOULD ADD A PR A
TO THIS INCREDIBLY CONFUSING AND
DETAILED COMPLEX PLOT IS IS
FRIGHTENING.
YOU'VE ALL SEEN THE ABUSES THAT
HAVE STEM FROM HAGA FROM HAVING
TRIAL LAWYERS AND FORCE THE
TECHNICALITIES OF GOVERNMENT
REGULATIONS IN THE EMPLOYMENT
CONTEXT AND NOW IMAGINE CREATING
THE SAME SYSTEM HERE FOR THE
VERY COMPLEX THE CPA.
AGAIN THEIR PRIVACY EFFORTS WHO
CAN'T AGREE ON CERTAIN ASPECTS
OF THIS LAW AND NOW WE'RE
TALKING ABOUT HAVING TRIAL
LAWYERS GO AFTER CALIFORNIA
BUSINESSES TO TEST THEIR ABILITY
TO DO SO.
IT WOULD BE A CLASS ACTION
BONANZA AND AS IT STANDS RIGHT
NOW 50% OF CLASS ACTION LAWSUITS
IN THIS COUNTRY ARE FILED RIGHT
HERE IN CALIFORNIA COURTS.
IMAGINE JUST HOW MUCH THAT
NUMBER WOULD INCREASE IF ALL THE
MANY REQUIREMENTS OF THE CPA ARE
SUBJECT TO A PRIVATE RIGHT OF
ACTION.
ESPECIALLY IN THE YEARS THAT
COME RIGHT AFTER THIS LAW TAKES
EFFECT IN BUSINESSES ARE TRYING
TO FIGURE OUT.
HOW TO MAKE THIS WORK FRANKLY
OUR COURT SYSTEM CAN'T HANDLE
THAT CALIFORNIA BUSINESSES CAN'T
HANDLE IT AND THE CALIFORNIA
ECONOMY CAN'T HANDLE THAT?
WE NEED TO FACE THE FACTS THE
CCPA IS GOING TO BE INCREDIBLY
CHALLENGING --
FOR COMPANIES TO COMPLY WITH
ESPECIALLY WHEN YOU THINK ABOUT
THE FACT THAT THE VAST MAJORITY
OF THE BUSINESSES THAT HAVE TO
COMPLY ARE NOT THE HANDFUL OF
TECH GIANTS IN THE STATE.
IT'S GOING TO BE AN ONGOING
PROCESS WE NEED TO FIX A LOT
WITH LEGISLATION IN WAYS THAT
WERE ABOUT TO DESCRIBE ON THIS
PANEL HERE TODAY WE NEED TO
ENSURE THE EACH SHE HAS THE
APPROPRIATE RESOURCES AND TIME
TO CRAFT THOUGHTFUL REGULATIONS.
AND WE NEED TO DO WHATEVER WE
CAN TO SET BUSINESSES UP FOR
SUCCESS BECAUSE THE PRIVACY
GOALS AT THE CCPA THAT WE ALL
CARE SO MUCH ABOUT WILL BE MET.
WHEN COMPANIES ARE ACTUALLY ABLE
TO COMPLY WITH THIS LAW
[inaudible]
NOW -- AGAIN
I SAID.
SERIBU WITH CAL CHAMBER TELL
CHAMBER REPRESENTS BUSINESSES
ACROSS EVERY INDUSTRY INCLUDING
OVER FOURTEEN THOUSAND SMALL
BUSINESSES MANY OF WHICH WILL BE
REQUIRED TO COMPLY WITH THE CCPA.
OBVIOUSLY EVERYONE HERE KNOWS
THIS LAW WAS PASSED WITH JUST
ONE WEEK IN THE LEGISLATIVE
PROCESS --
AND THAT WAS DUE TO THE
IMPENDING DEADLINE TO REMOVE THE
INITIATIVE FROM THE BALLOT.
BUT THE RESULT IS THAT ASPECTS
OF THIS LAW ARE CONFUSING AND
THEY DO PRESENT SERIOUS PRIVACY
CONCERNS AN OPERATIONAL
CHALLENGES THAT SHOULD BE
ADDRESSED --
DESPITE THAT REALITY IT IT FEELS
LIKE MOST OF THE ARTICLES THAT
YOU READ ABOUT CCPA OVER THE
PAST SEVERAL MONTHS HAVE
DESCRIBED YOU KNOW ANY BUSINESS
CONCERNS WITH THIS LAW IS BIG
TACK TRYING TO ROLL BACK RATES
AND WHAT WE ARE HERE TODAY TO
TELL YOU IS THAT THAT.
IS NOT THE CASE --
WE TOUCHED ON THIS EARLIER --
IN THE LAST PANEL IT WAS IT WAS
DISCUSSED THAT THE CCPA APPLIES
TO A MASSIVE SCOPE BUSINESSES
MORE THAN PEOPLE REALIZE MORE
THAN JUST DATA BROKERS ARE
COMPANIES THAT MAKE TWENTY FIVE
MILLION DOLLARS IN REVENUE OR
MORE --
THERE'S A THIRD CATEGORY IN A
BUSINESS IS THE ANNUALLY RECEIVE
PERSONAL INFORMATION UP FIFTY
THOUSAND OR MORE CONSUMERS
HOUSEHOLD OR DEVICES --
RESPECTFULLY DISAGREE WITH MR
ATTACK OR THAT --
YOU KNOW THAT SUCH A COMPANY
LIKE ADS AN AD SUPPORTED BLOG.
WOULD NOT HAVE TO COMPLY WITH
THIS LOT.
THE WAY THAT THE LAW IS WRITTEN.
ALL INFORMATION IS AN I. P.
ADDRESS AND IF A COMPANY IF AT
BLOCK GETS YOU KNOW FIFTY
THOUSAND HITS IN A YEAR ABOUT
WITH HER THIS NUMBER AS WELL
ABOUT AVERAGE OF A HUNDRED AND
THIRTY SEVEN HIT TODAY.
THEY ARE GONNA BE COVERED BY
THIS LAW WE ALSO BELIEVE THAT.
ARE BASED ON THE WAY THE LAW IS
WRITTEN SMALL BUSINESSES THAT
USUALLY CONDUCTS A HUNDRED AND
THIRTY SEVEN TRANSACTIONS IN A
DAY.
WHICH WOULD BE WAS PUT INTO
PERSPECTIVE ABOUT TWELVE
TRANSACTIONS PER HOUR OVER
TWELVE HOUR PERIOD WE'RE TALKING
ABOUT CONVENIENCE STORES COFFEE
SHOPS RESTAURANTS AND SO MANY
MORE.
THEY'RE ALL GOING TO BE COVERED
BY THIS.
AND THAT FIFTY THOUSAND THREE
HAS HAS FEWER THAN FIFTY
THOUSAND UNIQUE VISITORS BECAUSE
ONE CONSUMER UNDER THIS LAW
COULD BE COUNTED MULTIPLE TIMES
FOR EXAMPLE.
IF A CONSUMER PURCHASES AN ITEM.
IN A STORE ACCESS THE WEBSITE
FROM THEIR HOME COMPUTER AND
FROM A MOBILE DEVICE.
BUSINESS COULD ALSO MEET THE
THRESHOLD WITH SOME COMBINATION
OF THIS DATA FOR EXAMPLE THIRTY
THOUSAND CUSTOMERS IN THE STORE
TWENTY THOUSAND ONLINE HITS THE
POINT IS IT COVERS A LOT MORE
BUSINESSES AND PEOPLE REALIZE
AND I TREAT THEM ALL THE SAME AS
THE HANDFUL OF TECH GIANTS IN
THE STATE.
SO YOU LISTEN TO OUR TESTIMONY
TODAY WHICH IS ASKING YOU KEEP
ALL OF THIS RANGE OF BUSINESSES
IN MIND THAT MEET THE THRESHOLD
AND ASK YOURSELF HOW THEY'RE
GONNA BE ABLE TO COMPLY WITH
THIS LAWS IT'S CURRENTLY DRAFTED.
AND JUST PLEASE KEEP AN OPEN
MIND TO WORKING WITH US ON
FIGURING OUT SOLUTIONS TO SOME
OF THIS THESE PROBLEMS ARE
PRESENTING TODAY I'M GOING --
TO BRIEFLY DESCRIBE DESCRIBE TWO
OF OUR CONCERNS RELATED TO DATA
SECURITY AND PRIVACY --
AND WE HAVE ALREADY BEEN TOUCHED
ON A LITTLE BIT THE PREVIOUS
PANEL --
THIS EASY PAY REQUIRES
BUSINESSES TO SEND CONSUMER
SPECIFIC PIECES OF INFORMATION
THE BUSINESSES COLLECTED AFTER
RECEIVING A CONSUMER REQUEST.
BUT SPECIFIC PIECES OF
pCOULD MEAN THAT BUSINESSES MUST
TRANSMIT HIGHLY SENSITIVE
INFORMATION BACK TO CONSUMERS
LIKE CREDIT CARDS OR SOCIAL
SECURITY NUMBERS.
AS WELL AS LOCATION DATA OR
SPECIFIC INTERNET SEARCHES
INFORMATION CONSUMERS ALREADY
KNOW ABOUT THEMSELVES.
THE RISK OF FRAUD STIRS POSING
AS A CONSUMER TO GET ACCESS TO
THIS DATA INTO LEVY EIGHT THAT
RISK BUSINESSES MAY NEED TO
COLLECT EVEN MORE INFORMATION
FROM A REQUESTING CONSUMER TO BE
SURE.
IT'S SENDING SENSITIVE
INFORMATION TO THE RIGHT PERSON
ESPECIALLY WHEN A BUSINESS HAS
NO DIRECT RELATIONSHIP WITH THE
CONSUMER.
IS RUNS COUNTER TO THE PRIVACY
GOALS OF THIS RUMORS AND SO
WHERE CRESTING A CC PM AT TO
LIMIT THESE RISKS.
SECOND THE C. C. P.'S REFERENCES
TO HOUSEHOLDS AND DEVICES IN THE
DEFINITION OF PERSONAL
INFORMATION ALSO PRESENTS SOME
SERIOUS RISKS.
AS DRAFTED ONE MEMBER OF THE
HOUSEHOLD WHETHER THEY ON
ABUSIVE SPOUSE OR ROOMMATE SEEMS
TO BE ABLE TO ACCESS ALL THE
SPECIFIC PIECES OF PERSONAL
INFORMATION
AGAIN INCLUDING GEO LOCATION
DATA HOURS EVEN SHOPPING RECORDS
ABOUT ANOTHER MEMBER OF THEIR
HOUSEHOLD. FOR EXAMPLE HOUSEHOLD
MEMBER MAY REQUEST ACCESS TO
SPECIFIC PIECES OF INFORMATION
FROM GROCERY STORE DELIVERY
ITEMIZING ORDERS FOR THAT ENTIRE
HOUSEHOLD BASED ON ADDRESS.
AND THEN EXPOSE A HOUSEHOLD
MEMBERS PURCHASE OF SAY BIRTH
CONTROL OR PREGNANCY TEST.
SIMILARLY ONE USER OF A DEVICE
COULD REQUEST ALL THE SPECIFIC
PIECES OF INFORMATION A COMPANY
HAS ABOUT THAT PARTICULAR DEVICE
THE MERE FACT THAT A BUSINESS
HAS ANY DATA FOR A PARTICULAR
DEVICE COULD REVEAL PRIVATE
THINGS ABOUT ANOTHER USER.
OF THAT DEVICE TO THE PERSON
MAKING THE REQUEST.
AND NOT ONLY DOES THE INCLUSION
OF HOUSEHOLDS AND DEVICES
COMPROMISE PRIVACY OF CONSUMERS
IT COULD ALSO INFRINGE ON THE
CHOICES OF OTHER HOUSEHOLD
MEMBERS FOR EXAMPLE IF ONE
HOUSEHOLD MEMBER MAKES REQUEST
TO DELETE ALL THE DATA SO SHE TO
THE HOUSEHOLD.
ANOTHER HOUSEHOLD MEMBER WOULD
SUBSEQUENTLY BE UNABLE TO ACCESS
OUR HOUSE OF INFORMATION.
THIS RUNS COUNTER TO THE PRIVACY
GOALS OF THE CPA AND WE LOOK
FORWARD TO WORKING WITH ALL THE
TO FIX IT --
GOING TO TURN OVER TO OUR NEXT
PANELIST ERIC GOLDMAN AND AT THE
AT ONCE THE OTHER PANELISTS HAVE
SPOKEN I'VE ONE MORE ISSUE TO
ADDRESS BEFORE WE CLOSE OUT.
THANK YOU VERY MUCH.
NEXT PANELIST PLEASE --
YES HI --
THIS CHAIR AND MEMBERS OF THE
COMMITTEE --
THANK YOU FOR THE OPPORTUNITY
BECAUSE HEARING.
A MY NAME SIR COLEMAN I'M A
PROFESSOR AT ST CLAIR UNIVERSE
OF OUR SCHOOLS PRIVACY LAW
CERTIFICATE I'VE BEEN AN
INTERNET LAWYER FOR ABOUT TWENTY
FIVE YEARS --
MY REMARKS TODAY FOCUS ON THE
DEFINITION OF PERSONAL
INFORMATION --
THIS DEFINITIONS A CRITICAL
PIECE OF THE LAW BECAUSE IT
DISTINGUISHES BETWEEN THE
REGULATED AND UNREGULATED
INFORMATION --
AN OVERBROAD DEFINITION OF
PERSONAL INFORMATION CREATES --
THE PROBLEM THROUGHOUT THE
ENTIRE LAW WHICH I THINK IS THE
CASE TODAY --
THE DEFINITION PERSONAL RATIONS
DEFINED TO INCLUDE INFORMATION
THAT IS REASONABLY CAPABLE OF
BEING ASSOCIATED WITH A
PARTICULAR CONSUMER OR HOUSEHOLD.
IS A BUNCH OF EXCEPTIONS --
TO THERE'S MUCH EXAMPLES OF WHAT
THAT MIGHT INCLUDE --
THE DEFINITION DOESN'T LIMIT
ITSELF -- TO
TO SENSITIVE OR OBVIOUSLY
IDENTIFIABLE INFORMATION SUCH AS
NAME OR PHONE NUMBER OR SOCIAL
SECURITY NUMBER.
IT SITS UP EVERY SCRAP OF DATA --
THAT -- HAS
THE THEORETICAL CAPABILITY OF
BEING ASSOCIATED WITH THE
CONSUMER --
UNFORTUNATELY THIS DEFINITION
CRATES TODAY [inaudible]
UP FIRST ANY INFORMATION --
THAT RELATES TO CONSUMERS COUNTS
AS PERSONAL INFORMATION NO
MATTER WHAT STEPS A BUSINESS
MIGHT TAKE TO AVOID THAT OUTCOME.
THE LAW INCLUDES SOME CONSUMER A
DAY EXCLUDES SOME CONSUMER DATA
FROM THE DEFINITION OF PERSONAL
INFORMATION.
BUT THE SOLUTIONS THAT WORK THE
REASON WHY IS THAT COMPUTER
SCIENTIST INCREASINGLY CAN FIND
WAYS TO ASSOCIATE INNOCUOUS BITS
OF DATA WITH --
INDIVIDUAL CONSUMERS AS A RESULT
AT VIRTUALLY EVERY PIECE OF
INFORMATION FROM ABOUT CONSUMERS
TECHNICALLY MEETS THE STATUTORY
DEFINITION OF OF BEING RECENTLY
CAPABLE OF BEING ATTRIBUTED. TO
A PARTICULAR CONSUMER HOUSEHOLD
SO DESPITE THE LAWS CLEAR INTENT
OTHERWISE --
THE LAW TREATS ALL DATA IN A
BUSINESSES POSSESSION AS
PERSONAL INFORMATION AND
SUBJECTS THAT DATA TO THIS LOS
STRICT REQUIREMENTS.
OF MOST A LAWS OBLIGATIONS THAT
INCLUDES PORTABILITY DISCLOSURES
DELETIONS BECOME --
IMPOSSIBLE TO ADMINISTER IF ALL
THE INFORMATION AND CAN IN IT
BUT THIS IS POSSESSION IS
TREATED AS PERSONAL INFORMATION.
THE SECOND CONCERN IS THAT THE
LAW CREATES AN UNTENABLE
SITUATION WHEN A CONSUMERS
PERSONAL INFORMATION RESIDES IN
MULTIPLE DATABASES AND THE
CONSUMER TAKES ADVANTAGE OF THE
STATUTORY RIGHTS. TO ACCESS OR
DELETE THAT INFORMATION SO LET
ME GIVE AN EXAMPLE OF HOW THIS
MIGHT WORK --
ANOMALY RETAILER MIGHT ALLOW
CONSUMER TO CREATE A PERSONAL
PROFILE --
AND IT MIGHT ALSO A SEPARATE
DATABASE WORD DELIVERS CUSTOM --
PERSONALIZED DEALS BASED ON THE
IF THE CONSUMER ASK THE RETAILER
TO TO LEAD ALL THE INFORMATION
IN -- ALL
ALL OF HIS OR HER PERSONAL
INFORMATION --
THAT MIGHT BE EASY TO DO FOR THE
CONSUMER PROFILE BUT THEN THE
QUESTION IS WHAT'S THE BUSINESS
GOING TO DO ABOUT THE I. P.
ADDRESS IN THE SEPARATE --
OFFERS DATABASE THE LAW SIMPLY
REQUIRES THE RETAILER TO
DETERMINE THE CONSUMERS IP
ADDRESS IF THAT'S EVEN POSSIBLE
MANY I. P. ADDRESSES ARE SHARED
LIKE ON A WIFI NETWORK UPDATE
RETAILER.
DETERMINE THAT BELONG TO THE
CONSUMER AND THEN DELETED.
THIS REQUEST BECOMES EVEN MORE
UNREALISTIC WITH OFFLINE DATA
SAVED SECURITY --
CAMERA FOOTAGE OF THE CONSUMERS
SHOPPING IN THE STORE WHERE
SALES PERSONS NOTE OF THEIR
INTERACTIONS WITH THE CUSTOMER --
LOTS SAYS IT LINKING ACROSS
DATABASES IS REQUIRED BUT THIS
ONLY APPLIES IF THE INFORMATION
AND OTHER DATA BASES ISN'T
ITSELF PERSONAL INFORMATION.
BUT SENSE VIRTUALLY ALL DAY THE
IN --
BUSINESS VISION IS CHARACTERIZED
AS PERSONAL INFORMATION DECISION
ACTUALLY DOESN'T HELP INSTEAD
THE LAW MECHANIC PRODUCTIVELY
REQUIRE BUSINESSES TO DIGITIZE
MORE DATA SO THEY CAN --
AND PROACTIVELY LINK THEIR
DATABASES SO THEY CAN MAKE THOSE
FUTURE ACCESS OR DELETION
REQUEST EASIER --
THE THIRD --
CONCERN I HAVE IS THE DEFINITION
OF PERSONAL INFORMATION EXCLUDE
SOME GOVERNMENT --
PUBLISHED DATA BUT EVEN THAT IS
NOT REALLY USABLE UNDER LAW --
AND BROUGHT RISK --
MY LAST CONCERN OVER IS IS --
AS MISS --
BID OR DISCUSSED --
THE DEFINITION OF HOUSEHOLDS ARE
MEANS THAT A PERSON CAN SEE AND
IN FACT --
THE INFORMATION OTHER PEOPLE AND
THIS IS THE OPPOSITE OF PERSONAL --
THIS IS TO BE IS DEFINITION OF
PERSONAL INFORMATION REACHES
BEYOND THE ANALOGOUS GPR
DEFINITION --
THAT GPR DEFINES PERSONAL DATA
AS ANY INFORMATION RELATING TO A
IN IDENTIFIED OR DATA FIVE WILL
NOT A PERSON.
I DO HAVE SOME RESERVATIONS
ABOUT THE TREATY PR I DO HAVE
SOME CONCERNS ABOUT THIS
PARTICULAR DEFINITION BUT I
THINK LIKE THE SABER MENTIONED
EARLIER I BELIEVE THAT.
ADOPTING THAT DEFINITION WOULD
SOLVE SOME OF THE PROBLEMS THAT
WE'VE IDENTIFIED TODAY --
I'D VERY MUCH APPRECIATE
DRAFTING STRICTLY TODAY.
THANKS VERY MUCH ON A NEXT A
PANELS PLEASE.
MR CHAIRMAN MEMBERS OF THE
COMMITTEE THANK YOU FOR THE
OPPORTUNITY TO SPEAK TODAY
HAITIAN WHICH REPRESENTS OVER
FORTY FIVE LEADING INTERNET
COMPANIES.
INTERNET ASSOCIATION MEMBERS TO
SUPPORT THE SPIRIT OF CCPA TO
PROVIDE PEOPLE WITH MEANINGFUL
TRANSPARENCY AND CONTROL OVER
THEIR DATA.
INCLUDING THE ABILITY TO ACCESS
DELETE AND MOVE IT.
IN GRANTING THESE RIGHTS CCPA
REDEFINED SOME COMIC COMMONLY
UNDERSTOOD CONCEPTS ONE EXAMPLES
CONCEPT OF CELL.
AND WE UNDERSTAND THE WILL OF
THE LEGISLATURE IN MR TAGGART
WAS TO MAKE SURE THAT CONSUMERS
KNOW WHEN HOW AND TO WHOM THEIR
INFORMATION IS SOLD.
THIS IS SOMETHING INTERNET
COMPANIES ALSO SUPPORT.
HOWEVER IN REDEFINING CELL WE
BELIEVE CCPA UNINTENTIONALLY
JEOPARDIZES.
THE PRIVACY PROTECTIVE PRACTICES
USED IN ONLINE ADVERTISING.
I'LL TALK BRIEFLY ABOUT HOW THIS
WORKS WHY WERE CONCERNED WITH
THE NEW DEFINITION AND HOW WE
CAN FIX IT.
ONLINE ADVERTISING WAS DESIGNED
WITH PRIVACY IN MIND INSTEAD OF
CARRYING PERSONALLY IDENTIFIABLE
INFORMATION AROUND HE WEB.
ONLINE ADVERTISING USES
IDENTIFIERS THAT ARE NOT
DIRECTLY TIED TO INDIVIDUALS.
ADVERTISERS DO NOT NEED TO KNOW
WHO YOU ARE YOUR NAME ADDRESS OR
OTHER PERSONALLY IDENTIFIABLE
INFORMATION.
IN ORDER TO SHOW YOU AN AD
ONLINE BUT THEY DO NEED BASIC
DATA ACROSS THE WEB IN ORDER TO
DO SO.
CLICKING ON THE WEB PATIENTS
INFORMATION THAT'S NEEDED FOR
THE WEBPAGE TO POPULATE.
A WEB PAGE MAY DRAW FROM
NUMEROUS SOURCES ONE DATA BASE
SHOWING THE LATEST NEWS.
ANOTHER SHOWING A PHOTO ANOTHER
SHOWING STOCK PRICE STILL
ANOTHER SHOWING ADVERTISEMENTS
WHICH HELP SUPPORT AND PAY FOR
THE CONTENT OF YOUR VIEWS ON THE
PAGE.
MORE SPECIFICALLY CLICKING ON
THE PAGE SINCE THE I. P. ADDRESS
THE DATE AND TIME STAMP BROWSER
TYPE MOBILE OPERATING SYSTEM
TYPE SOME ADDITIONAL TECHNICAL
INFORMATION.
ABOUT THE ACTUAL DEVICE BEING
USED TO PROPERLY FORMAT THE
CONTENT.
AS WELL AS ANY COOKIE
INFORMATION ALL THESE DIRECT
WHICH CONTENT WILL POPULATE THE
PAGE INCLUDING WHICH AT BEST
FITS.
WE DO NOT BELIEVE THESE BITS OF
NON IDENTIFIABLE TECHNICAL
INFORMATION WHICH A BASIC
MECHANICS OF THE INTERNET ONE
TENDED TO BE COVERED BY CCP'S
DEFINITION OF SELF.
IN COMMON UNDERSTAND THIS
INFORMATION IS NEITHER PERSONAL
NOR IS BEING SOLD IN THIS
PROCESS.
TREATING THIS IS SELF PERSONALLY
FOR MIGHT INFORMATION
JEOPARDIZES THE UNDERPINNINGS OF
THE INTERNET.
IN ADDITION TO THE COMMONSENSE
NATURE OF NOT CONSIDERING THESE
DATA FLOWS A SALES I ONCE IN A
MOMENT A MEAN IF THEY WERE
CONSIDERED SALES.
MANY INTERNET SERVICES WE RELY
ON EVERY DAY ARE SUPPORTED BY AD
REVENUE THIS MODEL ALSO EMPOWERS
CREATORS AND ALLOWS THEM TO
SUPPORT THEMSELVES THROUGH
CONTENT.
SMALL PUBLISHERS ALSO MAKE A
LIVING BY WRITING BLOGS ON
EVERYTHING FROM COOKING TO
GARDENING TO COVERING COMMUNITY
NEWS AND GENERALLY SUPPORT ABOUT
ONLINE ADVERTISING.
LARGE PUBLISHERS AND CONTENT
PROVIDERS ALSO RELY ON AD
REVENUE TO SUPPORT THEIR
BUSINESS.
FURTHER MANY SMALL BRICK AND
MORTAR STORES HAVE BEEN ABLE TO
FIND THEIR NICHE AUDIENCES
EFFICIENTLY THROUGH ONLINE
ADVERTISING.
TOGETHER THIS MODELS
FOUNDATIONAL TO THE INTERNET
SECTOR CRITICAL FOR CALIFORNIA
TO PRESERVE.
MIS CHARACTERIZING ADVERTISING
IS A SALE OF DATA WOULD CONFUSE
THOSE CONCERNED ABOUT REAL SALES
OF THEIR ACTUAL PERSONAL
INFORMATION THAT IS TIED TO THE
NAME AND IDENTITY.
IF THE DATA IF THE ADVERTISING
DATA FLOW OR PUT THE SAME
BASKETS ACTUAL SALES PERSONAL
INFORMATION AND OP THAT A SALES
WOULD IN REVENUE FOR THE SIR
SERVICES PUBLISHERS AND LIMIT
THE ABILITY.
OF BUSINESSES TO FIND THEIR
CUSTOMERS.
WOULD ENDANGER BUSINESS MODEL
FUNDAMENTAL TO THE INTERNET.
AGAIN WE DON'T BELIEVE THAT THIS
WAS THE INTENTION IT MISTER
RETIRE CONFIRMED EARLIER THAT
WASN'T ALSO RECOGNIZE THE
IMPORTANCE OF PRESERVING THIS
PRACTICE WE APPRECIATE THAT.
HOWEVER WE FEEL THE STATUTES
UNCLEAR AT THE MOMENT.
IN ORDER TO CAPTURE THE INTENT
OF THE CPA AND TO PROTECT THIS
IMPORTANT BUSINESS MODEL WILL BE
ASKING FOR AN AMENDMENT TO MAKE
CLEAR THAT THIS PRACTICE THIS
DATA FLOW THAT I DESCRIBED --
IS NOT CONSIDERED THIS A SALE
UNDER THE ACT AND WE LOOK
FORWARD TO WORKING WITH THE
LEGISLATURE ON THE SOLUTION.
THANK YOU VERY MUCH AN EXTERNAL
IS PLEASE.
MORNING AN GOOD MORNING AGAIN MR
CHAIR MEMBERS.
FROM MY TIME ON THIS PANEL AGAIN
I'M TWENTY FOUR SITE WITH FREE
FOR KERN A KLEIN AND CELLS --
ON THIS PANEL GOING TO DISCUSS
THE CONCERNS THAT ARE RAISED BY
THE DEFINITION OF CONSUMER IN
THE CBA.
AND THE OVER REACH OF THE
PRIVATE RIGHT OF ACTION IN ITS
CURRENT FORM.
FIRST LET'S START WITH THE
DEFINITION OF CONSUMERS SO AS
WE'VE HEARD ALREADY ADEPT THE
CONSUMER IS A DEFINED TO BE ANY
CALIFORNIA RESIDENT.
IN THE CURRENT LAW.
DOES A QUOTE CONSUMER NEED NOT
HAVE A CUSTOMER RELATIONSHIP
WITH THE BUSINESS IN ORDER TO
EXERCISE THEIR RIGHTS UNDER THE
SEA.
WITHOUT CLARIFICATION THIS COULD
BE INTERPRETED TO INCLUDE
EMPLOYEES.
AND THAT OBVIOUSLY PRESENTS A
NUMBER OF CONCERTS.
KEEPING IN MIND THAT AS YOU'VE
HEARD THIS USED TO BE A PRICE TO
PIECES OF DATA DAY IP ADDRESSES
OR CREDIT CARD NUMBERS THE
OPERATIONAL COSTS FOR SMALL
BUSINESSES INCLUDING EMPLOYEES
PASSING CURRENT.
JOB APPLICANTS AND OTHER RELATED
INDIVIDUALS WHO DON'T HAVE A
TRUE CONSUMER RELATIONSHIP WITH
THE BUSINESS WILL BE EXORBITANT.
LET'S USE AN EXAMPLE A SMALL
FAMILY OWNED RESTAURANT THAT
SERVES ONE HUNDRED FIFTY TABLES
A DAY WILL HAVE TO
OPERATIONALIZE THE CCPA AS IN
ITS CURRENT FORM. FOR ITS
KITCHEN WAIT STAFF.
IN A BUSINESS WITH A VERY HIGH
TURNOVER RATE --
ALSO ACCESS TO PERSONAL
INFORMATION IN THE EMPLOYMENT
CONTEXT IS ALREADY ESTABLISHED
IN CALIFORNIA A LOT.
EMPLOYEES ALREADY HAVE THE RIGHT
TO ACCESS THE PERSONAL RECORDS
BUT THE CCPA WOULD ACTUALLY
ALLOW A SEPARATED SPOUSE IN THE
SAME HOUSEHOLD. TO GAIN ACCESS
TO THEIR HOUSES THEY'RE
SEPARATED THOUSANDS PAYROLL
RECORDS IF THEY'RE IN THE
HOUSEHOLD.
THAT CANNOT BE WITH THE
LEGISLATURE INTENDED.
THE DEFINITION OF CONSUMER IS
ALSO PROBLEMATIC IN THAT IT
CURRENTLY ENCOMPASSES BUSINESS
REPRESENTATIVES IN THE CONTEXT
OF BUSINESS TO BUSINESS
TRANSACTIONS.
THE OPPORTUNITY TO DO WE ARE OPT
OUT OF BUSINESS DATA IN A
BUSINESS TO BUSINESS TRANSACTION.
COULD RESULT IN FRAUD AND MAKE
IT IMPOSSIBLE TO COMPLY WITH DUE
DILIGENCE REQUIREMENTS.
IMAGINE ALSO WHAT THIS MEANS FOR
AS ANOTHER EXAMPLE A SMALL
MEDICAL PRACTICE THAT ALREADY
COMPLIES WITH HIPAA FOR PATIENT
DATA.
BUT THAT WILL NOW BE REQUIRED TO
HONOR OPT OUT AND DELETION
REQUEST FROM SUPPLIERS WITH WHOM
THE EMAIL.
BUT EVEN WHERE THOSE SUPPLIERS
DON'T HAVE ACCESS TO PATIENT
DATA THEY HAVE TO HONOR THE
HONOR THE OPT OUT IN SOLUTION
RIGHTS OF THE PEOPLE THERE
EMAILING WITH THE SUPPLIERS
THAT'S HOW THIS WORKS RIGHT NOW.
IN WASHINGTON STATE SENATE BILL
FIFTY THREE SEVENTY SIX
EXPLICITLY EXCLUDES.
EMPLOYEES OR CONTRACTORS OF A
BUSINESS WHEN THEY'RE ACTING IN
THOSE ROLES FROM THE DEFINITION
CONSUMER IN SECTION.
THREE CALIFORNIA SHOULD DO THE
SAME.
I WILL NOW TURN TO THE PRIVATE
RIGHT OF ACTION.
AS YOU ALL KNOW THE CCPA
CURRENTLY ALLOWS CONSUMER TO
SEEK STATUTORY DAMAGES OF ONE
HUNDRED TO SEVEN HUNDRED FIFTY
DOLLARS PER PERSON PER INCIDENT.
WITHOUT ANY DEMONSTRATION OF
HEART --
WHAT'S REQUIRED IS THAT THE
CONSUMERS PERSONAL INFORMATION
IS SUBJECT TO AN UNAUTHORIZED
ACCESS AND EXFILTRATION AFTER
DISCLOSURE.
AS A RESULT OF A BUSINESS IS A
VIOLATION OF THE DUTY TO
IMPLEMENT MAINTAIN REASONABLE
SECURITY PROCEDURES.
WE'VE HEARD A LITTLE BIT ABOUT
REASONABLE SECURITY TODAY AS WE
UNDERSTAND IT.
THE CGPA WAS MEANT TO EXCLUDE
ENCRYPTED DATA WE HEARD ABOUT
THAT ALSO AS WELL AS REDACTED
DATA.
WE ALSO HEARD FROM MR RETIRED
ABOUT THAT.
UNFORTUNATELY THE CURRENT
LANGUAGE DOESN'T EXACTLY SAY
THAT SO WE'D LIKE TO SEE THAT
ADDRESSED.
WHAT WHAT DO WE ACTUALLY KNOW
ABOUT THAT WANT TO TALK ABOUT
THIS FOR A MOMENT WE KNOW THAT
EVERY BUSINESS HAS EITHER HAD
THE DATA SECURITY BREACH EVERY
BUSINESS?
HAS EITHER HAD A DATA SECURITY
BREACH OR WILL.
EVEN IF THEY HAVE IMPLEMENTED
REASONABLE SECURITY PROCEDURES
AND PRACTICES.
IT IS THE NATURE OF THE WORLD IN
WHICH WE LIVE TODAY.
THE PARLIAMENT INSTITUTE AND
POLITICS JUST ISSUE THE RESULTS
OF A GLOBAL SURVEY OF SIX
HUNDRED OR MORE CYBERSECURITY
LEADERS IN PROFESSIONAL SHOWING
THAT 67%.
OF ORGANIZATIONS ARE NOT
CONFIDENT THAT THEY CAN AVOID A
DATA BREACH. ONE OF THE MOST
PERVASIVE THREATS TO COMPANIES
IS PHISHING ATTACKS WHICH ARE
BECOMING INCREASINGLY
SOPHISTICATED.
SO THIS IS CRITICAL TO
UNDERSTAND EVEN IF AN
ORGANIZATION HOUSING CRYPTID ALL
THE PERSONAL INFORMATION.
THAT IS NO SHIELD TO A FISHING
ATTACK.
BECAUSE IT APPEARS TO BE A
LEGITIMATE BUSINESS REQUEST.
SO LET'S GO BACK TO THE SMALL
FAMILY OWNED RESTAURANTS.
THE RESTAURANTS NIGHT MANAGER
DISCOVERS THAT HIS EMAILS BEEN
COMPROMISED OR PHISHING SCAM.
THAT APPEARED TO COME FROM HIS
OUTSOURCED IT GUY.
AND ASKED HIM TO ENTER HIS
CREDENTIALS.
NOW HE SUSPECTS THAT THE BAD
GUYS PROBABLY HAD ACCESS TO
PERSONAL INFORMATION OF
RESTAURANT CUSTOMERS THAT WERE
IN HIS ACCOUNT.
CALIFORNIA LAW ALREADY SAYS THAT
THE BUSINESS THE RESTAURANT HAS
TO NOTIFY THOSE AFFECTED
INDIVIDUALS AND BY THE WAY IF
THERE'S MORE THAN FIVE HUNDRED
AND THEY ALSO HAVE TO NOTIFY THE
AG'S OFFICE.
UNDER THE CCPA EACH OF THOSE
AFFECTED INDIVIDUALS CAN NOW
THROUGH THE RESTAURANT FOR ONE
HUNDRED SEVEN HUNDRED FIFTY
DOLLARS PER PERSON PER INCIDENT
WHERE THEY CAN BRING CLASS
ACTION.
YOU CAN SEE HOW THE SITUATION
QUICKLY SPIRALS OUT OF CONTROL.
IF THAT'S SMALL RESTAURANT
SERVES EVEN JUST WANT RUMORS A
WEEK OR SLIGHTLY MORE THAN FIFTY
THOUSAND UNIQUE CREDIT CARDS A
YEAR.
THE DAMAGE IS ATTRIBUTABLE TO
THE CLASS WOULD RANGE BETWEEN
FIVE MILLION DOLLARS ON THE LOW
END AND THIRTY SEVEN AND A HALF
MILLION DOLLARS ON THE HIGH END.
EVEN THE LOW END OF THAT RANGE
PLUS ATTORNEY'S FEES WOULD BE
ENOUGH TO BUY IT BANKRUPT ANY
SMALL BUSINESS.
IS WITHOUT POTENTIAL LIABILITY
IS BUSINESS OWNERS WILL BE
FORCED TO ENTER INTO IMMEDIATE
SETTLEMENT.
BECAUSE THE COSTS OF LITIGATION
ARE SO HIGH.
EVEN IF THEY THINK THEY HAVE A
GOOD DEFENSE BASED ON REASONABLE
SECURITY THEY'RE GONNA BE FORCED
TO SETTLE BECAUSE THEY CAN'T
AFFORD WOULD GAIN.
THE NET RESULT IS THAT THE TRIAL
ATTORNEYS WHEN BUTTHE CONSUMERS
WILL BE ANY MORE PROTECTIVE THAN
THEY ARE TODAY.
AS NOTED ALREADY IS NOT IF BUT
WHEN A COMPANY WILL HAVE A DATA
SECURITY BREACH.
AND THE ATTACKS ARE BECOMING
MORE SOPHISTICATED WITH
ORGANIZED CRIME IN NATION STATES
IN THE GAME.
CALIFORNIA BUSINESSES ARE THE
VICTIMS OF THESE ATTACKS BUT
THEY ARE PUNISHED BY THIS LAW.
THIS IS A SLEDGE HAMMER IT'S NOT
A STICK AND A COMES A POINT WHEN
DETERRENCE HAS DIMINISHING
RETURNS.
YOU HAVE THE OPPORTUNITY. TO
MAKE THIS LEGISLATION EVEN MORE
PROTECTIVE OF THE CONSUMERS AS
OPPOSED TO THEIR LAWYERS.
AND LESS DAMAGING TO THE
CALIFORNIA ECONOMY AS A WHOLE BY
CREATING A SAFE HARBOR TO THIS
ONEROUS LIABILITY.
BEYOND JUST THE ENCRYPTION
REDACTION OR REASONABLE SECURITY
AS I MENTIONED THERE ARE THINGS
LIKE FISHING THE DO NOT THAT
THOSE THINGS CANNOT ADDRESS.
OR BY SIMPLY REMOVING THE
MINIMUM AMOUNT OF STATUTORY
DAMAGES.
THANK YOU FOR YOUR TIME AND YOUR
CONSIDERATION.
THANKS VERY MUCH IN NEXT
PANELIST PLEASE.
MR JR MEMBERS THANK YOU FOR THE
OPPORTUNITY TO PRESENT TODAY.
MY NAME IS MARGARET LAST SEEN
I'M HERE ON BEHALF OF THE
CALIFORNIA RETAILERS ASSOCIATION.
I CONCUR WITH TESTIMONY BY THE
PREVIOUS PANELISTS HERE AND I
WANT TO EMPHASIZE THAT C. R.
A.'S DEEPLY CONCERNED WITH THE
EXISTING LIABILITY IN CC PA AND
WE CERTAINLY WOULD OPPOSE ANY
EXPANSION OF THAT LIABILITY.
WE'RE ALSO CONCERNED THAT
SECTION SEVENTEEN FIVE KNOWN AS
THE NONDISCRIMINATION SECTION
RAISES DOUBTS ABOUT THE LEGALITY
OF LOYALTY REWARDS PROGRAMS WE
APPRECIATE THAT MR MCTAGGART AND
SOME CONSUMER GROUPS BELIEVE
IT'S CLEAR THESE PROGRAMS CAN
CONTINUE.
BUT WE ARE UNCERTAIN ABOUT THE
CLARITY OF THE LAW WHAT IS CLEAR
IS THAT CONSUMERS EMBRACE THESE
PROGRAMS 80% OF ALL AMERICANS
HAVE OPTED INTO AT LEAST ONE
PROGRAM.
AND MOST POPULAR SUPERMARKET AND
DRUGSTORE PROGRAMS JURIES
MEMBERS OFFER REWARDS PROGRAMS
BECAUSE WE WANT TO ENCOURAGE
CUSTOMER LOYALTY.
JUST AS YOU USE DATA ABOUT
INDIVIDUAL VOTERS TO HELP OR TO
VOTE WE USE DATA TO HELP BERNIE
CUSTOMERS BUSINESS.
THE LAW CURRENTLY SAYS A
BUSINESS CANNOT DISCRIMINATE
AGAINST THE CONSUMER FOR
EXERCISING THEIR RIGHTS UNDER
CCPA.
BY DENYING GOODS OR SERVICES TO
THE CONSUMER CHARGING DIFFERENT
PRICES ARE RATES INCLUDING
THROUGH THE USE OF DISCOUNTS OR
OTHER BENEFITS.
AND PROVIDING A DIFFERENT LEVEL
OR OR QUALITY OF GOODS OR
SERVICES.
THE SAME SECTION GOES ON TO SAY
A BUSINESS MAY OFFER FINANCIAL
INCENTIVES INCLUDING PAYMENTS TO
CONSUMERS AS COMPENSATION FOR
THE SALE OR FOR THE COLLECTION
OR SALE OF PERSONAL INFORMATION.
I QUOTE HERE A BUSINESS MAY ALSO
OFFER A DIFFERENT PRICE RATE
LEVEL OR QUALITY OF GOODS OR
SERVICES TO THE CONSUMER IF THAT
PRICE OR DIFFERENCE IS DIRECTLY
RELATED TO THE VALUE PROVIDED TO
THE CONSUMER.
BY THE CONSUMERS DATA.
CONFUSING I WOULD SAY SO.
I APPRECIATE THE COUNTLESS HOURS
THAT WENT INTO DRAFTING THIS LAW
WITH THIS SECTION AND ITS
INTERPLAY WITH OTHER PARTS OF
THE LAW.
LEASE RETAILERS GROCERS HOTELS
HOTELS AND AIRLINES WONDERING
WHAT WE CAN AND CANNOT DO WITH
OUR LITTLE TOO YOU REWARDS
PROGRAMS.
WHY UNDERSTAND THE LEGISLATIVE
INTENT IS THAT WE CAN CONTINUE
TO OFFER THEM?
AND SEE AREAS MEMBERS WANT TO DO
SO WITHOUT RUNNING AFOUL OF THE
LAW.
ULTIMATELY IN THIS UNLESS THIS
SECTION IS CLARIFIED EITHER THIS
COMMITTEE NOR ANY LEGISLATIVE
BODY WILL DETERMINE THE MEANING
OF THESE WORDS.
INSTEAD IT WILL BE UP TO THE
COURTS TO RECKON THAT COULD BEAR
ON THESE PROGRAMS THAT'S THE
UNCERTAINTY WE WANT TO END
BEFORE IT ENDS LOYALTY PROGRAMS.
PERHAPS YOU'RE THINKING OUR
LOYALTY PROGRAMS SELLING MY DATA.
SHEARER SEE ARI'S MEMBERS ARE
NOT IN THE BUSINESS OF SELLING
DATA.
WE WANT TO SO GOODS AND SERVICES
BUT SOME OF THE MOST POPUAR
PARTS OF OUR PROGRAM.
COULD BE POTENTIALLY CONSIDERED
A SALE UNDER THE SWEEPING
DEFINITION IN CCPA FOR EXAMPLE
SAFE LIKE THE REWARDS CLUB
MEMBERS CAN EARN DISCOUNTS AT
CHEVRON AND JC PENNEY MEMBERS
CAN USE THEIR REWARDS POINTS.
FOR PER US PURCHASES AT SEPHORA
IS IN JC PENNEY'S.
WE SIMPLY WANT TO CONTINUE TO
OFFER THESE BENEFITS TO OUR
CONSUMERS WE LOOK FORWARD TO
WORKING WITH YOU TO PROTECT
THESE PROGRAMS WHILE PROTECTING
THE FRAMEWORK OF CCPA.
THANK YOU VERY MUCH A NICE
PANELS PLEASE.
THANK YOU AGAIN MISTER CHAIR AND
MEMBERS SERRA BOOT ON BEHALF OF
CAL CHAMBER JUST HAVE ONE LAST
ISSUE TO COVER TO CONCLUDE OUR
TESTIMONY --
ON THIS PANEL --
I KNOW AS PUBLIC SERVANTS ALL OF
YOU ARE YOU KNOW ESPECIALLY
INTERESTED ENSURING THAT
GOVERNMENT PROGRAMS ARE ABLE TO
OPERATE EFFECTIVELY.
UNFORTUNATELY THE CCPA PLACES
RESTRICTIONS ON THE SALE OF DATA
TO GOVERNMENTAL ENTITIES THAT
WILL HAVE A PROFOUNDLY NEGATIVE
IMPACT ON MANY CRUCIAL
GOVERNMENT SERVICES.
GOVERNMENT AGENCIES PRODUCE
PURCHASE DATA FROM BUSINESSES
FOR A WHOLE HOST OF NECESSARY
REASONS HERE'S JUST A FEW
EXAMPLES --
THE SCREENING OF MEDICAL
PROVIDERS TO ENSURE THERE'S
NOTHING IN THERE HISTORY THAT
WOULD PREVENT THEM FROM.
OUR PROVIDING PATIENT CARE
SEARCHING TO REUNITE FOSTER
YOUTH RELATIVES AS WELL AS TO
ASSESS THE SUITABILITY OF WOULD
BE FOSTER PARENTS.
CHILD SUPPORT ENFORCEMENT
ACTIVITIES FRAUD PREVENTION AND
PUBLIC RETIREMENT ACCOUNTS AND
OTHER GOVERNMENTAL BENEFITS
PROGRAMS.
LAW ENFORCEMENT RESPONSES FOR
CRIMES AND THE CHILDREN IF BAD
ACTORS CAN OPT OUT OF THE SALE
OF THEIR DATA TO GOVERNMENTAL
ENTITIES FOR THESE LIMITED KINDS
OF PURPOSES VALUABLE PURPOSES.
ALL THE EFFORTS I JUST DESCRIBED
COULD BE THWARTED.
THE CZ PA'S OPT OUT PROVISION
ALSO UNDERMINES LEGAL COMPLIANCE
ACTIVITIES AND EFFORTS TO
PREVENT IDENTITY THEFT.
TAKE FOR EXAMPLE THE IMPORTANT
WORK TO FIGHT MONEY LAUNDERING
UNDER THE CURRENT LAW IS DRAFTED --
A COMPANY THAT'S PROVIDING ANTI
MONEY LAUNDERING DATA SERVICES
TO A BANK.
IS NOT DIRECTLY SUBJECT TO
ENTITLED WONDERING MONEY
LAUNDERING LEGAL OBLIGATIONS AND
SO CANNOT CLAIM A LEGAL
COMPLIANCE EXEMPTION.
IT'S ALSO NOT A SERVICE PROVIDER
UNDER THE LAW WHICH MEANS A FIRM
HANDLING DATA AT THE DIRECTION
OF A BUSINESS SUCH AS A BANK
INSTEAD.
THE ANTI MONEY LAUNDERING
COMPANIES A BUSINESS ITSELF
PUTTING TOGETHER SERVICE WHICH
IT THEN PROVIDES TO THE BANK.
A SERVICE FOR WHICH UNDER THE
CPA.
ALLOWS BAD ACTORS TO OPT OUT AND
EVEN IF THEY DETECTION.
THIS EASY PAY ALREADY RECOGNIZED
AS PART OF THIS PROBLEM IN THE
DELETION SECTION OF THE LAW
WHICH HAS AN EXEMPTION STATING
THAT A BUSINESS NEED NOT DELETE
DATA THAT'S NECESSARY TO DETECT
SECURITY INCIDENTS OR TO PROTECT
AGAINST MALICIOUS.
DECEPTIVE FRAUDULENT OR ILLEGAL
ACTIVITY THAT SAME TYPE OF
EXEMPTION SHOULD BE APPLIED TO
THE RIGHT TO OPT OUT OF THE SALE
OF DATA FOR THESE LIMITED
PURPOSES --
WITH THAT AGAIN JUST WANT TO
THANK YOU MISTER CHAIRMAN REFER
YOUR ATTENTION FOR LISTENING TO
OUR CONCERNS A FOR HOLDING THIS
FORUM SO THAT WE CAN DISCUSS
THEM -- WITH
THE CCPA CALIFORNIA IS THE FIRST
IN THE COUNTRY TO ESTABLISH SUCH
A ROBUST SET OF PRIVACY RIGHTS.
AND IF WE CAN FIX THAT WE REALLY
COULD BE A MODEL FOR THE REST OF
THE COUNTRY BUT WE DO HAVE TO
GET IT RIGHT.
AND WE LOOK FORWARD TO WORKING
WITH ALL OF YOU TO DO SO IS OF
ALL THIS LANGUAGE --
AND THANK YOU SO MUCH FOR YOUR
TIME THANK YOU VERY MUCH THANKS
OUR PANELISTS PLEASE.
THANK YOU MISTER --
FOR NUMBER POINTS HERE --
JUST TAKE THEM IN IN IN SOMEONE
IN ORDER YOU KNOW --
I THINK THE PRESS GOLDMAN
ACTUALLY. FOR ME ARGUMENT THAT
DID THIS INCREASING ABILITY OF
COMPANIES TO ASSOCIATE TINY
LITTLE BITS OF INFORMATION WITH
US.
INFORMATION WE DON'T YOU THINK
IS OF AS PERSONAL.
IS EXACTLY WE'RE TRYING TO GET
AND SO --
YOU KNOW THE THE THE THE THE THE
IDEA THAT THESE ARE NOT PERSONAL
BITS OF INFORMATION I I FIND
ACTUALLY.
IS MISLEADING BECAUSE INCREASING
THINGS WE DON'T THINK OF IT IN
FOR HIS PERSONAL FURNISH ARE
BECOMING PERSONAL INFORMATION.
BROUGH VIDEO CAMERAS WE HAVE --
ONE TIME EXEMPTIONS IN BOTH OR
ONE TEN ONE AT ONE HUNDRED SIX
ONE HUNDRED ONE AND ONE TEN
WE'RE THIS IS DON'T HAVE TO KEEP
PERSONAL INFORMATION --
IF IT'S NOT CONSIDERED PERSONAL
INFORMATION SO YOU KNOW OUR OUR
THOUGHT THERE WAS WE DIDN'T WANT
TO HAVE A SITUATION WHERE YOU
HAVE TO CRAWL THROUGH ALL YOUR
DID VIDEO SECURITY FOOTAGE --
WE HAVE THOUGHT ABOUT THESE
THINGS THAT THE THE IMPLICATION
LATER ON THAT THE THE BROWSER
TYPE AND THE COOKIES ARE NOT
PARTICULAR ABOUT PERSONAL
INFORMATION THIS IS EXACTLY HELP.
YOU'RE BEING TRACKED AT ALL
TIMES NOW --
BECAUSE YOUR BROWSER TYPE AND
THE COOKIES ON YOUR PHONE THE
LAST TIME YOU DID THIS APP OR
DIFFERENT EVERYTHING ONE OF US
IN THIS ROOM HAS A DIFFERENT
PHONE AND IT'S CALLED BROTHER
FITTING FINGERPRINTING.
SO YOU'RE BEING TRACKED ACROSS
THE INTERNET ON ALL --
THIS IDEA THAT --
BUSINESS TO BUSINESS
TRANSACTIONS WE DIDN'T THINK
ABOUT WITH A WHOLE LIST OF
THINGS YOU CAN'T OPT OUT OF THIS
BECAUSE THE LAST POINT THERE
ABOUT SECURITY.
YOU CAN'T OPT OUT OF THE SALE OF
YOUR INFORMATION FOR DETECTING
SECURITY INSTANCE THE PROTECTING
ITS MALICIOUS DECEPTIVE
FRAUDULENT OR ILLEGAL ACTIVITY.
YOU KNOW DEBUGGING THERE'S OF
THE WHOLE LIST OF THINGS --
AND IT SOUNDS GOOD TO SAY THAT
THEY'RE ALL THESE FLAWS THE LAW
BUT THE REALITY IS WE DID SPEND
SOME TIME THINKING ABOUT THESE
THINGS AND TO TRY TO ANTICIPATE
THEM.
WITH RESPECT TO THE DATA BREACH
BUT AT THE SMALL BUSINESSES CAN
BE AFFECTED AGAIN.
YOU COULD YOU DATA --
YOU KNOW THIS IS LIKE SAYING GET
AN ANTI VIRUS --
WE ALL KNOW THAT WE SHOULD HAVE
AN ANTI VIRUS --
A SOMETHING AND YOU KNOW A
PROGRAM IS CALLED OUR COMPUTER --
AND WE DO HAVE THESE UP WE THINK
VERY REASONABLE THRESHOLDS FOR
COMPANIES WHERE --
AT THE DATA WHICH IS --
ONLY IMPACT YOU IF YOU REALLY
HAVEN'T TAKEN REASONABLE CARE OF
THE PERSONAL INFORMATION YOU'RE
BEING ENTRUSTED WITH --
YOU KNOW WITH RESPECT TO LAW
ENFORCEMENT NOT BE ABLE.
TO YOU KNOW TRACK YOU.
THE IMPLICATION IF YOU TO CARRY
THAT TO THE TO THE EXTREMEIS
THAT WOULD BE A SAFER SOCIETY OF
ALL OF US WERE SURVEIL AT ALL
TIMES AND ALL OF OUR INFORMATION
WERE ABLE TO BE TRACKED BY THE
POLICE WELL LET'S.
JUST NOT THE WAY OUR OR WORLD
WORKS.
AND AGAIN BECAUSE WE HAVE THE
RIGHT THAT THE THE BILL YOU
CAN'T OPT OUT OF THE SALE OF
YOUR INFORMATION TO TRANSFER
YOUR INFORMATION FOR THESE.
VERY MANY THAT YOU NEED IT
PURPOSES WE THINK WERE.
ELIZABETH DO YOU HAVE ANY.
ENDING.
FOR SURE HI ELIZABETH GILLIES
ADVICE PRESIDENT COMMON SENSE
KIDS ACTION THANK YOU TO THE
COMMITTEE AND MEMBERS --
COMMITTEE MEMBERS FOR HAVING US
HERE TODAY.
UP.
I JUST BY WAY OF STEPPING BACK
FOR A MOMENT I I THINK TODAY
WERE HERE FOCUSING ON WORK
ABILITY FOR INDUSTRY AND I WANT
TO REMIND --
ALL INVOLVED THAT WHEN WE TALK
ABOUT THE WORD CONSUMERS --
WE'RE REALLY TALKING ABOUT OUR
COMMUNITIES OUR PARENTS OUR
FRIENDS OUR NEIGHBORS OUR
FAMILIES OUR GRANDPARENTS AND
ALL CALIFORNIANS WHO NEED THIS
OUGHT TO BE WORKABLE FOR THEM SO
THERE'S WORKABLE FOR INDUSTRY
AND WORKABLE FOR CONSUMERS --
WE APPRECIATE THE LEGISLATURE IN
PARTICULAR THIS COMMITTEE FOR
THEIR WORK IN ESTABLISHING AND
CONSIDERING CHANGES TO THE CPA.
COMMONSENSE SIDE A LOT
LEGISLATIVE ALTERNATIVE T.
INITIATIVE LAST YEAR PRECISELY
SO THAT WE CAN CONTINUE TO BUILD
PRIVACY RIGHTS FOR CONSUMERS AS
A RESULT OF THE LEGISLATIVE
PROCESS.
RIGHTS THAT WOULD COVER NOT JUST
SELLING AND SHARING BUT ALSO
USING COLLECTION AND IN A
FRAMEWORK THAT DEFAULTS TO
CONSENT --
TO GET INTO SOME OF THE SPECIFIC.
FEEDBACK FROM THIS PANEL A YOU
KNOW IN IN TERMS OF THIS YOU
KNOW OUR GOALS IN TERMS OF
PROTECT STRONG PRIVACY RIGHTS
APPOINT TO THE CHAMBERS OWN
PRIVACY PRINCIPLES INTRODUCED
LAST FALL THAT STATE BUSINESSES
SHOULD BE TRANSPARENT.
ABOUT THE COLLECTION USE AND
SHARING.
WE LIKE TO SEE TRANSPARENCY
AROUND COLLECTION AND USE AS
WELL --
ALEXA FOR EXAMPLE SHOULD NOT
WITHOUT MY KNOWLEDGE OR CONSENT
BE COLLECTING AUDIO OF MY
FAMILIES AND ACTUALLY MY KIDS
CONVERSATIONS AND STARING THAT
STORING THAT DATA. FOR TO USE
FOR FUTURE PROFILING AND
TARGETING --
SO IN TERMS OF ONLINE
ADVERTISING WHICH WAS BROUGHT UP --
TARGETED ADVERTISING ON SITES
WILL BE ABLE TO CONTINUE UNDER
THE LAW IF AS KEVIN STATED THAT
IF THEY'RE NOT WILLING TO AN
INDIVIDUAL.
WE ARE CONCERNED ABOUT
MANIPULATIVE ADVERTISING
PRACTICES INCLUDING IN ELECTIONS --
THAT ARE MEANT TO MANIPULATE
CONSUMERS AND OUR DEMOCRACY.
SO IT PROVIDING IT EVEN MORE
EXPLICIT CARVE OUT FOR TARGETED
ADVERTISING.
WILL ALLOW THESE PRACTICES TO
CONTINUE AND WE WANT TO ENSURE
THAT'S NOT THE CASE --
THE BUSINESS RELATIONSHIP
AMENDMENT --
THAT SERRA ALLUDED TO IT.
EARLIER THAT DOES EXIST UNDER
EXISTING SHINE THE LIGHT LAW AND
IN TWELVE YEARS OF THAT LOBBYING
ACLU AND CALPERS AND OTHERS SAY
SHOWN THAT.
BUSINESSES HAVE NOT BEEN
COMPLYING --
TO THE ATTORNEY GENERAL'S POINTS
EARLIER COMMONSENSE.
FOR US SUPPORTS THE REQUEST FOR
MORE ROBUST ENFORCEMENT
MECHANISMS BEYOND THOSE PROVIDED
IN THE CASE OF A DATA BREACH.
WE CAN HAVE A STRONG LAW BUT IF
IT'S NOT IN FORCE CONSUMERS LOSE
OUT.
WE HAVE COMMON SENSE FOR
PROPONENTS OF THE NATION'S FIRST
CONSUMER PRIVACY LAW CALIFORNIA
SO PIPPA AND WERE NOT AWARE OF A
SINGLE ACTION BEING FILED SINCE
IT WENT INTO EFFECT IN JANUARY.
TWENTY SIXTEEN WE'RE CONCERNED
ABOUT THE ATTORNEY GENERAL'S
OFFICE CAPACITY TO TAKE ON A
HUGE BURDEN OF ENFORCEMENT THAT
THEY ARE TASKED WITH IT IN THIS
FRAMEWORK.
AND WELCOME ENFORCEMENT
INCLUDING BY LOCAL ENTITIES SUCH
AS TO GAYS AND CITY ATTORNEY'S.
G. P. R. WHICH COMPANIES NOW
SEEM TO BE POINTING TO AS A FREE
MARKETS WORKABLE QUITE DIFFERENT
FROM THE SENTIMENTS EXPRESSED IN
THE YEAR LEADING UP TO
IMPLEMENTATION --
I WILL POINT OUT CARRIES WITH IT
DATA MANIPULATION AS WELL AS A
PRIVATE RIGHT OF ACTION WHICH
THERE IS A CAUSE OF ACTION THAT
INDIVIDUALS CAN TAKE.
THAT ADVOCATES CAN TAKE ON
BEHALF OF AN INDIVIDUAL --
AS WELL AS HAS A NOTICING
CONSENT OFTEN FRAMEWORK AND
WE'VE SEEN FINES AND PENALTIES
LEVIED SHOWING ITS IMPACT AND
NOTE THAT SIMILAR RULES TO GPR
EXISTED PRIOR.
AND GPR ACTUALLY ADDED PENALTIES
WHICH FORCED THE INDUSTRY TO
COMPLY.
WHY SHOULD AMERICANS
CALIFORNIANS IN THIS CASE HAVE
FEWER RIGHTS THAN EUROPEANS IF
INDUSTRY WOULD LIKE COMPLIANCE
TO HARMONIZE A BRIEF AS WE'VE
HEARD TODAY WITH G. P. R. THAN
CONSUMER RIGHT SHOULD BE
HARMONIZED AS WELL?
WHICH INCLUDES OPTING CONSENT
THE RIGHT SHIN AND A PRIVATE
RIGHT OF ACTION WHICH ARE ALL
NOT IN THE CURRENT CALIFORNIA
FRAMEWORK.
I THANK YOU VERY MUCH OUT ITS ME
BACK TO COMMITTEE QUESTIONS
COMMENTS FROM COMMITTEE MEMBERS.
SEEN AND LET ME DO IT LET ME
JUST -- TO
MAKE THIS THE MAN I I AM PLEASED
TO REPORT THAT MANY OF THE
ISSUES THAT WE HAVE HEARD TODAY.
ARE INDEED ON OUR RADAR IN FACT --
OUR PRIVACY TEAM HAS BEEN
WORKING DILIGENTLY WITH MANY OF
THE STAKEHOLDERS AND IN FACT
MANY OF YOUR HERE AT THE TABLE
AND I'M EXCITED BECAUSE YOU KNOW
WE'RE ALL WORKING ON THIS --
ON THIS LIST TOGETHER THIS LISTA
KEEPS ON GROWING A BETTER AS WE
GO BUT I AM --
REALLY ARE GRATEFUL FOR YOUR
INPUT I THINK THESE ARE GREAT
AND PUTS IN AND I THINK MANY OF
THE ISSUES THAT RIGHT THERE ARE
HAVE BEEN REYES ARE.
ALL LEGITIMATE CONCERNS THAT THE
WE ARE WILL BE LOOKING INTO --
AS WE GO SO --
WITH THAT IF THERE ARE NO AND
MOVE ON TO THE NEXT PANEL.
ALL RIGHT NOW I'D LIKE TO
WELCOME HOW FOURTH PANEL
SPEAKERS WHO WILL HELP AS SO
LOOK AHEAD.
IN MAINTAINING A LEAD IN PRIVACY.
THIS CAN OF COURSE MEAN MANY
THINGS TO MANY DIFFERENT PEOPLE
AND I KNOW THERE'S A LOT THAT
CALIFORNIA CAN STILL DO ASSUMING
OF COURSE THAT THE FEDERAL
GOVERNMENT DOESN'T --
PREEMPT WHAT WE HAVE ALREADY
DONE AND ANY FUTURE EFFORTS SO I
LOOK FORWARD TO HEARING --
FROM THIS PANEL ON THEIR
THOUGHTS ON ALL OF THE ABOVE --
WITH US TODAY WE HOW FAR IS
NICOLE ALWAYS ART HAS --
ESQUIRE WHO IS THE TECHNOLOGY
AND CIVIL LIBERTIES DIRECTOR
FROM ACLU OF CALIFORNIA WE ALSO
HAVE A MISTERLEE TN.
SENIOR STAFF ATTORNEY AND ADAMS
CHAIR FOR INTERNET RIGHTS
ELECTRONIC FRONTIER FOUNDATION.
CAUGHT WEAVER FOUNDER AND CHIEF
EXECUTIVE OFFICER OF A PURISM
OSCOTT JORDAN PROFESSOR AT UC
IRVINE AND FORMER CHIEF
TECHNOLOGY OFFICER AT THE FCC
ASHCAN ARE SO TINY.
INDEPENDENT RESEARCHER AND
TECHNOLOGIES TEN ARCHES AND WHO
IS WHO IS ALSO THE FORMER CHIEF
TECHNOLOGIST AT THE F. T. C..
SIR BIRD OUT FROM CALIFORNIA
CHAMBER OF COMMERCE AND TANYA
FOR* A PARTNER AND PRIVACY
AND DATA SECURITY GROUP CHAIR
ARE THANK YOU ARE WELCOME. TO
THE LEGISLATURE WILL GET STARTED
WITH THAT MISS --
OZARK MISSED THE CLINIC THANK
YOU THANK YOU CHAIR IN THANK YOU
I COMMITTEE MEMBERS ON THE ACLU
HAS MORE THAN THREE HUNDRED
THOUSAND MEMBERS HERE IN
CALIFORNIA AND WE WORK ACROSS.
TEN OFFICES IN THE STATE WE
REALLY TRY TO USE OUR STRENGTH
TO ENSURE THAT THE VOICES OF
THOSE DIRECTLY IMPACTED ARE
HEARD IN THE JUDICIAL PROCESS
AND THE POLITICAL PROCESS.
I'D LET THE IF YOU'LL USE WORK
HERE IN CALIFORNIA ON CONSUMER
PRIVACY GOVERNMENT SURVEILLANCE
FREE SPEECH AND NEW TECHNOLOGY
SINCE.
TWO THOUSAND FOUR I'VE WORKED IN
THE IN THE COURTS IN THE
LEGISLATURE WITH COMPANIES AND
WITH COMMUNITIES BOTH HERE AND
NATIONALLY.
YOU'VE TITLED THIS PANEL
MAINTAINING A LEAD IN PRIVACY
AND TO THE ANSWER THE QUESTION
ABOUT WHERE WE SHOULD GO WE
REALLY NEED TO START WITH THE
FOUNDATION.
WHAT CALIFORNIA GUARANTEES TO
ALL OF US TO ALL OF YOU TO ME TO
OUR FAMILIES AND TO FORTY
MILLION CALIFORNIANS?
ARTICLE ONE SECTION ONE OF THE
CALIFORNIA CONSTITUTION THE VERY
FIRST PROVISION IN THE
DECLARATION OF RIGHTS IS CLEAR.
WE HAVE BEEN IN THE ONLY NOBLE
CIVIL AND HUMAN RIGHTS AS
CALIFORNIANS ARE RIGHT THE COULD
NOT BE BOUGHT.
OR SOLD TO BOTH PURSUE AND
OBTAIN PRIVACY.
THE CONSTITUTIONAL RIGHT TO
PRIVACY WAS PASSED
OVERWHELMINGLY BY THE VOTERS IN
THE NINETEEN SEVENTIES TO
SUPPOSED TO SPECIFICALLY ADDRESS
EXACTLY THE MODERN THREAT TO
PERSONAL PRIVACY THAT WE SPEAK
ABOUT TODAY.
AS THE CALIFORNIA SUPREME COURT
HIGHLIGHTS IN ITS SEMINAL CASE A
WHITE BE DAVIS THE MOVING FORCE
BEHIND THE NEW CONSTITUTIONAL
PROVISIONS WAS A FOCUSED PRIVACY
CONCERNS.
THING CROUCH MEN ON PERSONAL
FREEDOM AND SECURITY CAUSED BY
INCREASED SURVEILLANCE AND DATA
COLLECTION IN CONTEMPORARY
SOCIETY.
OUR CONSTITUTIONAL RIGHT TO
PRIVACY IS BROADER THAN THE
FOURTH AMENDMENT.
TAX ALL OF US AGAINST INTRUSIONS
BY BOTH THE GOVERNMENT AND
BUSINESS.
AND A RIGHT TO PRIVACY PROTECTS
ALL OF OUR PERSONAL INFORMATION
AS THE CALIFORNIA SUPREME COURT
HAS MADE CLEAR CALIFORNIA
DOESN'T HAVE A MYOPIC VIEW OF
PERSONAL INFORMATION BUT INSTEAD
TAKES A VERY TAX NEUTRAL
APPROACH.
IF THE INFORMATION CAN OFFER A
VIRTUAL CURRENT BIOGRAPHY IT IS
COVERED BY THE CALIFORNIA
CONSTITUTION.
AND FOR EXACTLY THAT REASON THE
CALIPH AS FOR DECADES DEFINE
PERSONAL INFORMATION AS ANY
INFORMATION THAT IDENTIFIES.
RELATES TO DESCRIBES OR IS
CAPABLE OF BEING ASSOCIATED WITH
YOU OR WITH ME.
AND AS THE CALIFORNIA SUPREME
COURT HAS ALSO MADE ABUNDANTLY
CLEAR ARE CONSTITUTIONAL RIGHT
TO PRIVACY IS FUNDAMENTAL AND
COMPELLING.
AS THE BALLOT INITIATIVE SAYS
THE RIGHT TO PRIVACY WAS ADDED
TO THE CONSTITUTION TO PROTECT
OUR HOMES.
OUR FAMILIES OUR THOUGHTS OUR
EMOTIONS ARE EXPRESSIONS OUR
PERSONALITIES.
OUR FREEDOM OF COMMUNION AND OUR
FREEDOM TO ASSOCIATE WITH THE
PEOPLE WE CHOOSE.
OUR RIGHT TO PRIVACY
SPECIFICALLY PREVENTS THE OVER
BROAD COLLECTION AND RETENTION
OF PERSONAL INFORMATION AND THE
IMPROPER USE OF THIS INFORMATION
THE USE OF IT FOR ANOTHER
PURPOSE OR THE DISCLOSURE OF IT
TO SOME OTHER THIRD PARTY.
CALIFORNIA WAS WISE TO PUT IN
PLACE OUR CONSTITUTIONAL RIGHTS
TO PROTECT US IN THE MODERN
DIGITAL WORLD.
AND THE LEGISLATOR HAS ACTED IN
VERY IMPORTANT BIPARTISAN WAYS
OVER THE YEARS TO BE A LEADER
AND PASSED PRIVACY LAWS TO
FURTHER OPERATIONALIZE THESE
RATES.
THESE ARE LAWS THAT MANY IN THE
BUSINESS COMMUNITY FOUGHT
AGAINST WITH THE SAME TYPE OF
CLAIMS WE HEARD ABOUT TODAY.
THESE ARE LAWS ON PRIVACY
POLICIES AND DATA BREACH
NOTIFICATIONS THE PRECURSOR TO
SEE CPA THE TWO THOUSAND THREE
SHINE THE LIGHT LAW.
AND DOZENS OF CRITICAL PRIVACY
PROTECTIONS AGAINST IDENTITY
THEFT AND PROTECT WOMEN CHILDREN
AND SENIORS.
THESE LAWS HAVE NOT ONLY BEEN
EMINENTLY WORKABLE BUT ALSO
EMULATED IN OTHER STATES WHAT
NEWS STORY AFTER NEWS STORY HAS
MADE CRYSTAL CLEAR IS THAT THE
ONLY THING THAT I'M WORKABLE
RIGHT NOW IS THE SHARP DIVIDE
BETWEEN THE CONSTITUTIONAL
PRIVACY RIGHTS ALL CALIFORNIANS
ARE GUARANTEED.
I WHAT CALIFORNIA STATUTORY LAW
IS CURRENTLY MAKING A REAL FOR
PEOPLE.
AND THE ONLY THING BEING STIFLED
RIGHT THE ACTUAL SECURITY OF
CALIFORNIANS.
WE ALL NOW KNOW ABOUT CAMBRIDGE
ANALYTICA AND HOW THE PRIVATE
AND INCREDIBLY SENSITIVE
INFORMATION OF EIGHTY SEVEN
MILLION PEOPLE WITH SHARED.
THE TRUE RAMIFICATIONS ON THE
POLITICAL PROCESS UNKNOWN.
BUT THAT'S JUST THE TIP OF THE
ICEBERG.
THERE BEEN MASSIVE BREACHES
MARRIOTT EQUIFAX YAHOO TARGET WE
STILL DON'T KNOW WHAT THE FULL
FOLLOW AT THESE AND SO MANY
OTHERS WILL BE.
BUT WE KNOW THE CALIFORNIANS
WOULDN'T BE SITTING DUCKS IF WE
HAD THE RIGHT MECHANISMS TO
CONTROL OUR PERSONAL INFORMATION.
AND THERE'S SO MANY OTHER
STORIES THAT ARE RECEIVED MUCH
LESS PRESS BUT WITH NO LESS
GRAVE CONSEQUENCES FOR THE
PEOPLE IN CALIFORNIA.
PARTICULARLY FOR AN INCREASING
NUMBER IN OUR COMMUNITIES YOUNG
AND OLD WHO ARE EXPERIENCING
FINANCIAL STRESS THE
PROLIFERATION OF WEB WHINING
PERSONAL INFORMATION BEING USED
TO DETERMINE IF WE ARE OFFERED
SERVICES.
HOME LOANS CREDIT CARDS
INSURANCE CAN BE PARTICULARLY
DESTABILIZING.
IN HOUSING A RECENT STUDY FROM
BERKELEY HOT SHOWS HAVE DATED
DRIVEN MORTGAGE LENDING IS
PERPETUATING ECONOMIC INEQUALITY
AND DISCRIMINATION.
AFRICAN AMERICAN AND LATINO
BORROWERS ARE PAYING AN AVERAGE
FIVE POINT SIX BASIS POINTS
HIGHER TRANSLATING INTO COSTS OF
FIVE HUNDRED MILLION DOLLARS FOR
MINORITY BORROWERS.
IN JOBS A CARNEGIE MELLON STUDY
REVEALED THE DATED TRIMMING
GOOGLE ADS FOR HIGH PAYING JOBS
ARE BEING DISPROPORTIONATELY
SHOWN TO MEN.
RATHER THAN TO WOMEN.
AND JUST THIS YEAR IT WAS
DISCOVERED THAT FACEBOOK DATA
COLLECTION IS BEING USED TO
ALLOW ADVERTISERS TO EXCLUDE
LATINO BLACK AND OTHER ETHNIC
AFFINITY USERS FROM SEEING
INFORMATION ABOUT HOUSING.
EMPLOYMENT AND JOBS.
MORE THAN YOU FACEBOOK TWITTER
AND INSTAGRAM WE'RE SHARING DATA
WITH THIRD PARTIES ACROSS THE
COUNTRY.
THIS DATA WAS BEING USED TO
MONITOR AND TARGET UNIONS AND
PROTESTERS WHO ARE CHARACTERIZED
AS OVERT THREATS.
AND YOUNG PEOPLE THE STORY BROKE
JUST A COUPLE WEEKS AGO THAT
THIS BOOK WAS GETTING USERS AS
YOUNG AS THIRTEEN TO INSTALL AN
APP TO TRACK THEIR HABITS.
AND THE GIVE THE COMPANY ACCESS
TO EVERYTHING THEIR PHONE SENT
OR RECEIVED OVER THE INTERNET.
NOT TO MENTION THAT IN RECENT
YEARS THE PRIVACY COMMUNITY HAS
DISCOVERED THAT MARKETERS HAVE
BEEN COMPILING AND SELLING LIST
OF RAPE VICTIMS.
THOSE SUFFERING FROM HIV AND
AIDS AND SENIORS WITH DEMENTIA.
WHAT'S CLEAR IS THAT WE ARE A
CRITICAL JUNCTURE FOR PERSONAL
PRIVACY IN CALIFORNIA AND THE
COUNTRY WE ARE FIGHTING ABOUT
WHETHER WE CAN CONTROL OUR OWN
LIVES.
AND WE'RE FIGHTING ABOUT WHETHER
THIS COMMITTEE AND OTHER
CALIFORNIA LEGISLATURE'S WILL BE
ABLE TO CONTINUE TO BE IN A
POSITION TO DEFEND THE RIGHTS
SAFETY AND SECURITY OF ITS
PEOPLE.
OR WILL THE FEDERAL GOVERNMENT
AND BUSINESS GROUPS LIKE THE
CHAMBER OF COMMERCE AND INTERNET
ASSOCIATION BE ABLE TO STRIP
THAT AWAY.
I WANTED TO THANK ASSEMBLY
MEMBER GALLAGHER FOR HIS WORDS
THIS MORNING AND FOR HIS
POWERFUL LETTER WITH OTHERS THIS
WEEK TO CONGRESS ON PREEMPTION.
IT IS IMPORTANT THAT CONGRESS
KNOWS THAT ARE LAWMAKERS WILL
NOT ALLOW A FEDERAL LAW TO BE
PASSED THE PREAMPS AND
UNDERMINES THE RIGHTS OF
CALIFORNIA AND THE PRIVACY
RIGHTS OF ITS PEOPLE.
AND WE MUST WORK RESOLUTELY HERE
INSIDE CALIFORNIA MORE CAN AND
MUST BE DONE TO MAKE SURE THE
CONSTITUTIONAL RIGHTS OF
CALIFORNIANS REMAIN MORE THAN
WORDS ON PAPER.
THAT THESE PRIVACY RIGHTS ARE
REAL TO ALL PEOPLE.
FIRST THERE ARE SOME CRITICAL
PRIVACY AND CIVIL RIGHTS
LIMITATIONS OF CCPA THAT NEED TO
BE ADDRESSED TO PROTECT
CALIFORNIANS.
WE NEED TO MAKE SURE THAT THAT
SOMETHING LIKE CAMBRIDGE
ANALYTICA CAN NEVER HAPPEN AGAIN.
THE CALIFORNIA CONSTITUTIONAL
PRIVACY RIGHTS ARE TRULY FOR ALL
CALIFORNIANS AND THE COMPANY
STOP MAKING HOLLOW APOLOGIES AND
ACTUALLY RESPECT OUR RIGHTS.
NUMBER ONE REAL KNOWLEDGE ABOUT
WHAT'S HAPPENING TO OUR PERSONAL
INFORMATION WE ARE TALKING ABOUT
INFORMATION THAT CAN IDENTIFY US
AND OUR FAMILIES.
THEY CAN SWING ELECTIONS
INFILTRATES AND MAKE IT
IMPOSSIBLE FOR US TO SHARE IN
THE CALIFORNIA DREAM AND GET
DECENT JOBS PETER CHILDREN AND
PUT A ROOF OVER OUR HEADS.
WE NEED THE RIGHT MECHANISMS TO
KNOW WHAT'S REALLY HAPPENING TO
OUR PERSONAL INFORMATION WHAT'S
BEING COLLECTED AND SHARED AND
WITH WHO.
RIGHT NOW THE CCPA ONLY TELLS
CALIFORNIANS THE CATEGORIES OF
THIRD PARTIES.
ARE PERSONAL INFORMATION IS
SHARED WITH KNOWING PERSONAL
INFORMATION WAS SHARED WITH A
RESEARCHER IS DRASTICALLY
DIFFERENT THE KNOWING OUR
PRIVATE READING.
POLITICS A RELIGIOUS VIEWS WERE
SHARED WITH CAMBRIDGE ANALYTICA.
KNOWING PERSONAL INFORMATION WAS
SHARED WITH A FINANCIAL
INSTITUTION IS DRASTICALLY
DIFFERENT THAN KNOWING WHAT
PERSONAL INFORMATION WAS SHARED
WITH THE BANK THEY DENIED OUR
MORTGAGE.
AND IF YOU DON'T KNOW WHAT
PERSONAL INFORMATION HAS BEEN
SHARED AND WHO IT HAS BEEN
SHARED WITH YOU ALSO HAVE NO WAY
TO FOLLOW THE TRAIL.
AND CORRECT MISTAKES OR STOP
YOUR PERSONAL INFORMATION FROM
BEING MISUSED DOWN THE LINE.
NUMBER TWO REAL POWER TO CONTROL
HOW OUR PERSONAL INFORMATION IS
SHARED AND FOR COMPANIES TO GET
OUR PERMISSION FROM THE START.
IS CHAIRMAN CHAO'S SAID THIS
MORNING THIS IS COR.
RIGHT NOW THE CCPA ONLY PROVIDES
A MECHANISM FOR CALIFORNIANS TO
STOP THE SALE OF OUR PERSONAL
INFORMATION AND PUTS THE BURDEN
ON EACH OF US TO OPT OUT. TO
UNDERSTAND WHY WE MUST HAVE THE
POWER TO CONTROL ALL THE WAYS
OUR PERSONAL INFORMATION IS
SHARED AND NOT JUST SOLD.
CONSIDER FOR A MOMENT THAT THESE
PROCLAIMS THAT IT DOES NOT SELL
ANY INFORMATION WHAT SO EVER.
INSTEAD FACEBOOK CLAIMS IT JUST
SHARES PERSONAL INFORMATION AND
THE SCOPE OF THE SHARING IS
TRULY DIZZYING IT IS THE
PERSONAL INFORMATION OF BILLIONS
OF PEOPLE IN MORE THAN HALF A
DOZEN DIFFERENT WAYS.
APPS WEBSITES INTEGRATIONS
DEVELOPERS PARTNERS AND MORE AND
IT'S NOT JUST FACEBOOK MOST OF
THE MAJOR TECHNOLOGY COMPANIES
REPRESENTED BY THE BUSINESS
GROUPS THIS MORNING. TO MAKE
SOME OR ALL OF THEIR MONEY MY
INFORMATION CLAIM THEY DON'T
SELL ANY PERSONAL INFORMATION
EITHER.
COVERING JUST SAIL IS OBSOLETE
OUT OF THE GATE.
AND UNDERSTAND WHY WE MAKE MUST
MAKE COMPANIES ASK OUR
PERMISSION FROM THE START AND
NOT MAKE IT OUR BURDEN TO OPT
OUT.
JUST IMAGINE FOR A MOMENT TRYING
TO OPT OUT IF YOU DON'T ACTUALLY
KNOW WHO HAS YOUR PERSONAL
INFORMATION.
DO YOU KNOW ALL THE COMPANIES
WHO HAVE YOUR PERSONAL
INFORMATION.
HOW WILL YOU OPT OUT?
AND EVEN IF WE KNOW SOME OF THE
COMPANIES THEY HAVE VERY STRONG
FINANCIAL INCENTIVES TO MAKE IT
AS DIFFICULT AS POSSIBLE FOR US
TO OPT OUT.
MR MAKE THAGARD SAID THAT IT
SWITCHED FROM OFTEN OPT OUT FOR
LEGAL REASONS BUT WE ARE THE
ACLU WORK ON MORE CONSTITUTIONAL
CASES ON BOTH PRIVACY AND FREE
SPEECH THAN ANYONE ELSE.
GOODNESS KNOWS WE HARDLY EVER
STOP TALKING ABOUT FREE SPEECH.
BUT THIS ARGUMENT DOES NOT HOLD
WATER CALIFORNIANS OF ALL AGES
HAVE A CONSTITUTIONAL RIGHT TO
PRIVACY AND THEY'RE STILL AN OPT
IN FOR YOUNG PEOPLE WHICH IS
GOOD.
BUT THERE CAN AND SHOULD BE AN
OPT IN FOR ALL PEOPLE.
FINALLY REAL RIGHTS THAT ARE
EQUAL FOR ALL AN ARE PROPERLY
FOLLOWED BY COMPANIES THE RIGHT
TO PRIVACY IS A CIVIL AND HUMAN
RIGHT IS AN INALIENABLE RIGHT
FOR ALL CALIFORNIANS.
CCPA HAS A LOOPHOLE THAT MUST BE
CLOSE TO MAKE SURE THERE CAN BE%
NO DISCRIMINATION AND PEOPLE
CANNOT BE PUNISHED WITH HIGHER
PRICES OR DEGRADED SERVICE. FOR
EXERCISING THEIR PRIVACY RIGHTS
CHAIRMAN CHAO YOU SAID IT THIS
MORNING AND ALSO ELOQUENTLY LAST
YEAR IN A SENATE HEARING ON
BROADBAND PRIVACY.
PEOPLE SHOULD BE IN CONTROL OF
THEIR OWN PERSONAL DATA AND THAT
PRIVACY SHOULD NOT BE A LUXURY
RESERVED FOR THOSE WHO CAN
AFFORD IT.
THAT'S EXACTLY RIGHT.
FINALLY PER ALL RIGHTS WE HAVE
AND THEREFORE MUST BE PERSONALLY
ENFORCEABLE.
AS THE AG HAS MADE CLEAR THERE
NEEDS TO BE A FULL PRIVATE RIGHT
OF ACTION.
EVERY CALIFORNIAN MUST BE ABLE
TO SEEK REDRESS IN COURT AGAINST
COMPANIES THAT VIOLATE THE LAW
JUST AS THEY CAN WITH ANY OTHER
PERSON ALL RIGHT.
THANK YOU FOR INVITING ME TO
SPEAK TO YOU TODAY FOR LETTING
ME TALK ABOUT THE IMPACT OF
PRIVACY ON THE REAL PEOPLE IN
OUR COMMUNITIES IN CALIFORNIA.
WITH THE IS STILL YOU LOOK
FORWARD TO WORKING WITH THIS
COMMITTEE AND MANY OTHERS TO
MAKE SURE THE CALIFORNIA LAW IS
FURTHER UPDATED AND THE PRIVACY
SAFETY AND FINANCIAL SECURITY
ALL CALIFORNIANS.
IS PROTECTED THANK YOU VERY MUCH
AND NEXT PANELIST PLEASE
[inaudible]
MR.
FORMER PROVIDING THE ELECTRONIC
FRONTIER FOUNDATION --
TO SPEAK TODAY MY NAME IS LEE TM
AND I MANAGE LEGISLATIVE AFFAIRS
ADF OFF --
BOTH IN DC IN SACRAMENTO AND
STATE LEGISLATURES CROSS COUNTRY.
IF UP IS NEVER BEEN SO BUSY IN
OTHER STATES BEFORE AND THE
REASONS REALLY SIMPLE PRIVACY IS
A HUGE ISSUE FOR ORDINARY PEOPLE
TODAY.
PUBLIC OFFICIALS ACROSS THE
COUNTRY GET IT.
AND THEY KNOW THAT CALIFORNIA'S
LEADING THE FIGHT.
NOW INDUSTRY ALSO SAT UP AND
STARTED AYING ATTENTION WHEN
THE CCPA CAME ON THE SCENE.
YOU KNOW IT WAS AND IS AN
IMPORTANT STEP.
TOWARD TRULY IMPLEMENTING OUR
CONSTITUTIONAL RIGHT OF PRIVACY.
ABOUT RIGHTS DON'T PROTECT
THEMSELVES AND THAT'S WHY WE'RE
HERE AND THAT'S WHY WE'RE
ACTUALLY GOING TO BE HERE BROKE
FOR MANY YEARS TO COME AS WE GET
BETTER AND BETTER AT THIS.
I WANTED TO ADDRESS A COUPLE OF
THE POINTS OF THE IN SOME OF THE
EARLIER --
COMMENTS YOU KNOW ONE OF THE
THINGS I THINK THAT'S GOING TO
BE REALLY IMPORTANT IN THIS
AREAS DEALING WITH --
THE ISSUE OF THE ADVERTISING
INDUSTRY AND ITS BUSINESS MODEL --
BUT I THINK ONE OF THE THINGS
THAT THAT WAS THAT I FOUND
INTERESTING LISTENING TO THE
EARLIER PANEL WAS THAT.
YOU KNOW PEOPLE ARE.
BEGINNING TO SAY NICE THINGS OR
SAYING NICE THINGS ABOUT THE GPR
AT THE SAME TIME ABSORB
CRITICIZING THE CCPA.
AND YET WHEN YOU LOOK AT ON AN
AREA LIKE ADVERTISING AS A
BUSINESS MODEL YOU SEE THAT THE
GPR IS ACTUALLY RIGHT NOW --
YOU KNOW REALLY PUTTING THAT
ADVERTISING MODEL IN UNDER A LOT
OF STRESS --
AND THIS IS THE A BIG CHANGE I
MEAN IN TWENTY SEVENTEEN YOU
KNOW WE SAW A FRENCH REGULATOR
THE NEIL --
IMPOSE UP FINDS ON ON GOOGLE FOR
VIOLATIONS I THINK IT WAS
FACEBOOK A HUNDRED AND FIFTY
THOUSAND EUROS.
YOU KNOW NOW WE'RE SEEING YOU
KNOW POTENTIALLY EIGHT FIGURE
FINDS UNDER GPR THAT IS REALLY.
WHAT IS GETTING THEM TO TAKE
NOTICE --
THERE WAS A RECENT MUCH MORE
RECENT UP FINDING AGAINST A A
COMPANY YOU'VE NEVER HEARD OF
AND I'D NEVER HEARD OF VICTORIA --
WHERE THERE WAS AN ISSUE ABOUT
WHETHER OR NOT THEY COULD
DEMONSTRATE THAT CONSENT HAD
ACTUALLY BEEN --
OBTAINED WHO THEY WERE --
WHOSE PERSONAL INFORMATION THEY
WERE SENDING OUT.
AS PART OF THE ADVERTISING
INDUSTRY SORT OF REAL TIME
BIDDING EXCHANGE.
SO WE WE DON'T SEE HOW WHETHER
YOU CALL IT SALES.
OR SHARING --
AND WHY THAT SHOULD MAKE A
DIFFERENCE WHEN YOU ARE LOOKING
AT THE POTENTIAL IMPACT OF THIS
PERSONAL INFORMATION BEING
SHARED AND RIGHT NOW WE'RE NOT
SEEING THAT.
THE GPR AUTHORITIES ARE GOING TO
ARE GOING TO BE A SPECIALLY FOR
GIVING ABOUT THAT.
BUT THERE WAS ALSO AN ISSUE
WE'VE SEEN.
ABOUT THE DEFINITION OF CONSUMER
A ONE ON ONE POINT I WANTED TO
MAKE ABOUT THAT WAS.
THERE SEEM TO BE A CONCERN THAT
WHILE YOU MIGHT NOT BE A
CONSUMER OF THIS PARTICULAR
COMPANY YOU MIGHT HAVE A
BUSINESS RELATIONSHIP WITH THEM --
BUT IN FACT THAT'S PART OF THE
PROBLEM THAT'S PART OF THE POINT
RIGHT ON YOUR INFORMATION
TRAVELS FROM THE COMPANIES YOU
DO KNOW ABOUT. TO THE COMPANIES
YOU DON'T KNOW ABOUT --
AND AT THAT POINT --
UNDER EXISTING LOTS OF VERY VERY
HARD TO DO ANYTHING ABOUT IT AND
INDEED.
WELL THE FACT THAT --
YOU KNOW AS NICK IS THAT.
THE HOW CAN YOU DO ANYTHING TO
SAY OPT OUT OF THE SALE THAT
INFORMATION IF YOU DON'T KNOW.
WHO THEY ARE AND THIS IS A
PROBLEM I SEE IN THE ADVERTISING
INDUSTRY IS ALSO A PROBLEM WITH
SOME UP FAMILIAR LARGE ACTORS
LIKE DATA BROKERS --
LIKE EXPERIENCE LIKE EQUIFAX YOU
KNOW WE ARE GENERALLY NOT.
CUSTOMERS OF THEM THEIR
CUSTOMERS AND THEIR CLIENTS ARE
OTHER BUSINESSES --
FOR THEM OUR DATA IS SIMPLY --
FOR US TO BE ABLE TO HAVE
CONTROL OVER THEM IT'S AND IT
CAN'T BE POSSIBLE --
YOU SHOULDN'T BE ABLE TO LIMIT
THE CONSUMER RELATIONSHIP TO
JUST SOMEONE WAS A DIRECT.
FACE TO FACE RELATIONSHIP WITH
THE COMPANY.
ANOTHER ISSUE THAT THE THAT
WE'VE DISCUSSED THIS QUESTION OF
OF OCT IN VERSUS OPT OUT AND
MAKE YOU ALREADY ADDRESSED THIS
TO SOME EXTENT BUT YOU KNOW WE
WOULD LIKE TO AGREE THAT.
YOU KNOW WE DON'T THINK THAT THE
FIRST AMENDMENT DRAWS THIS
INCREDIBLY BRIGHT LINE.
BETWEEN OPT IN AN OPT OUT --
YOU KNOW WE HAVE WE ARE ALSO
LOOKING VERY MUCH AT WE SPEECH
RIGHTS WE BELIEVE THAT YOU KNOW
FREE SPEECH IS SOMETHING THAT IS
ENJOYED.
BY ALL SORTS OF ENTITIES UP BUT
IT IS IT IS A NOT SO SIMPLE AS
OPT OUT IS OKAY.
OFTEN IS NOT --
ONE OF THE LEADING CASES FOR
INSTANCE --
SO ROUTE WHICH AS A SUPPORT FOR
THE IDEA THAT --
YOU CAN'T HAVE OFTEN.
I THINK THAT'S A VERY VERY
DISTINGUISHABLE CASE --
IT IS IT DEALT WITH THE SALE OF
CERTAIN KINDS OF PRESCRIBING
INFORMATION IT WAS NOT EVEN TIED
DIRECTLY. TO THE INTERESTS OF
THE PATIENTS IN PRIVACY AND BACK
WHEN IT WAS REALLY THE SPRING
COURT WAS LOOKING AT QUESTIONS
OF WHETHER THE PRESCRIBERS --
SHOULD HAVE PRIVACY SO I THINK
THAT -- YOU
YOU CAN'T REALLY ALIGNED ON
THOSE KINDS OF CASES BUT YOU'RE
THINKING ABOUT THIS.
I'M YOU KNOW THE BIGGER QUESTION.
IS.
WHO HAS THE BURDEN?
ALL WHO IS BEARING THE COSTS.
OF WHEN WE ARE TALKING ABOUT
CONSENT OPT IN OPT OUT --
BECAUSE NUMEROUS STUDIES HAVE
SHOWN THAT THE CONSUMER.
IN ORDER TO GET OUT.
ACTUALLY INFORM THEMSELVES PAST
DUE IN NORMAN WOULD HAVE TO DO
AN ENORMOUS AMOUNT BEHAVIORAL
ECONOMICS IS FULL OF STUDIES
THAT TALK ABOUT.
HOW MANY HOURS WOULD TAKE TO
READ PRIVACY NOTICES CENTER IT'S
SORT OF THE NOSE AND CHOICE
MODEL IN THAT SORT OF PLANT?
HAS A PROBLEM BECAUSE IT PUTS
TOO MUCH OF A BURDEN ON THE
INDIVIDUAL AND NOT ENOUGH ON THE
COMPANIES WHO ARE IN FACT.
THE ONES THAT KNOW WILL --
WHERE AT WHAT IS HAPPENING TO
OUR INFORMATION AND WHERE IT
GOES?
INDEED THEY MAY ALSO BE THE ONLY
ONES UNDER FORMS THAT THAT SEES
A STARTED --
AND THAT WE WANT MORE OF RENTS
SINCE -- I
DON'T THINK THE CHAMBER UP THE
LAST LETTER I THINK IN AUGUST
THE THE CHAMBER WAS NOT
SUPPORTIVE.
OF THE IDEA OF SPECIFIC PIECES
OF INFORMATION BEING GIVEN OUT --
AND YET.
THERE IS A BIG DIFFERENCE
BETWEEN KNOWING THAT --
SOMEONE A SHARED YOUR BROWSING
HISTORY --
AND ACTUALLY BEING ABLE TO SEE
THE BROWSING HISTORY THAT THEY
SHARE A MOCK MY MOTHER.
HAS NO CONCEPT OF WHAT FOR
BROWSING HISTORY CONTENT --
MOST PEOPLE DON'T THEY DON'T
KNOW THAT LOCATION AND SHARED
THEY DON'T KNOW THAT ALL SORTS
OF OTHER INFORMATION ABOUT USE
WHAT IS ACTUALLY AND THAT IT AND
THE CLICK STREAM --
UP FURTHER MORE --
I THINK THE CHAMBERS HAVE
PROBLEMS WITH THE INCLUSION OF
THE CONCEPT OF INFERENCES AS
SOMETHING THAT THE COMPANY WOULD
HAVE TO SHARE.
AND YET I THINK MANY OF US WILL
REMEMBER --
BEING SURPRISED WHEN --
THE NEW YORK TIMES MAGAZINE DID
AN ARTICLE SEVERAL YEARS AGO
ABOUT HOW --
TARGET WAS ABLE TO CONSTRUCT.
A PREGNANCY ASSESSMENT BASED ON
THE KINDS OF GOODS THAT PEOPLE
WERE BUYING IT WERE ABLE TO
ACTUALLY IDENTIFY WITH SOME
DEGREE OF ACCURACY --
WHEN A WOMAN WAS IN HER SECOND
TRIMESTER OF PREGNANCY?
NOW.
IF YOU DIDN'T KNOW THAT WAS
POSSIBLE YOU WOULD NEVER
UNDERSTAND.
WHAT TARGET Y. TIGHT WITH
INTERESTED IN THAT INFORMATION
YOU WOULD UNDERSTAND HOW WAS
BEING USED AND YOU WILL
UNDERSTAND THE THREAT THAT
PERSONAL INFORMATION EVEN WHEN
IT SEEMS VERY INNOCUOUS --
CAN BE IN THE HANDS OF LARGE
COMPANIES THAT HAVE A LOT OF OF
DATA MINING ABILITY --
SO WE THINK THAT.
FROM A CONSUMER STANDPOINT --
FROM THE STANDPOINT OF ACTUALLY
BEING ABLE TO PROTECT OURSELVES --
FOR BEING ABLE TO COLLECTIVELY
UNDERSTAND --
THE THREAT TO PRIVACY THE
COMPANIES START POSING IT WE
REALLY NEED TO HAVE OF THESE
KINDS OF OF PROTECTION.
NOW I ALSO WANTED TO GO TO THE
QUESTION WHAT FORCE MEANT --
AND AGAIN VERY SIMPLE WE SUPPORT
STRONGLY --
THE NOTION THAT THERE SHOULD BE
PRIVATE RIGHT OF ACTION --
IN THE CCPA --
YOUNG WE AGREE WITH THE AG THAT
EXPANDING PRIVATE RIGHT OF
ACTION MAKES SENSE --
IN FACT MANY PRIVACY STATUTES
RIGHT NOW CAN LAWS ON WIRE TAPS
STORED ELECTRONIC COMMUNICATIONS.
VIDEO RENTALS DRIVER'S LICENSES
AND SO ON AND SO DO MANY OTHER
KINDS OF LAWS.
THAT PROTECT THE PUBLIC FEDERAL
LAWS ON CLEAN WATER.
EMPLOYMENT DISCRIMINATION ACCESS
TO RECORDS.
ALSO YOU KNOW AGENCIES
THEMSELVES --
EVEN THOUGH WE WE LOVE THE
AGENT'S OFFICE BEING IN.
CHARGE OF OF THE PRIVACY
REGULATION HERE AT THE SAME TIME
WE'VE ALSO HEARD THAT THEY HAVE
A RESOURCE ISSUE --
AND YOU KNOW THE FTC ITSELF YOU
SEE DURING THE RECENT SHUT DOWN
DOT PUT PAS.
ON THEIR ATTEMPTS --
TO TO SANCTION OF FACEBOOK.
THERE IS AN INHERENT RISK MORE
OVER A REGULATORY CAPTURE --
WHEN YOU HAVE AN FORTUNATE
CENTRALIZED?
NOW ONE OF THE DIFFERENT THINGS
WE SEEN GPR IS INCREDIBLY
DECENTRALIZED REPORTING SYSTEM.
NOT ONLY DPA SAID EVERY EVERY
OTHER COUNTRY AND HOMBURG
GERMANY DOES HAS ITS OWN DEEP
YET -- SO
THERE IS AN ENORMOUS AMOUNT OF
ENFORCEMENT POSSIBILITY THAT
WE'RE GONNA SEE UNDER JEEP GPR
AND MANY OF THE LARGEST
COMPANIES HERE ARE ACTUALLY
GOING TO BE --
YOU KNOW IN THE CROSS HAIRS OF
THOSE ALREADY AND WAS QUITE
BEING REQUIRED. TO COMPLY.
BUT WE THINK THAT WITH PRIVATE
RIGHT OF ACTION WE'RE GOING TO
INCREASE SORT OF THE PORTFOLIO
NATURE OF ENFORCEMENT HE WON'T
JUST BE ONE INCENTIVE THEY'LL BE
MANY DIFFERENT TYPES OF
INCENTIVES --
AND THIS IS GOING TO PUT MORE
PRESSURE ON THE COMPANIES TO BE
ACCOUNTABLE UP FROM THE PRIVACY
AND SECURITY STANDPOINT --
I DON'T WANT TO BE --
I'M GOING TO HAVE ONE LAST POINT
WHICH IS.
THE IMPORTANCE OF PORTABILITY IN
THE CURRENT LAW --
WE THINK THAT A PART OF OF REAL
CONTROL OVER WHAT COMPANIES ARE
DOING IS THE ABILITY TO VOTE
WITH YOUR FEET.
IF YOU WANT TO LEAVE A SERVICE
CAN YOU TAKE YOUR DATA WITH THE
OR WILL THEY ARE HOLDING HOSTAGE.
ABOUT THE CZ PA A STARTED DOWN
THIS PATH WITH A GOOD RIGHT TO
POOR DATA PORTABILITY --
WE JUST WANT TO CLOSE A FEW LOOP
THIS ISN'T JUST A PRIVACY ISSUE
RIGHT I MEAN AS WE'VE SEEN AT
THE FEDERAL LEVEL.
ON THERE'S A LOT MORE CONCERNED
ABOUT THE COMPETITIVE.
ASPECTS HOW IS YOU KNOW IS THERE
TOO MUCH MARKET POWER
CONSTRICTED AND SOME COMPANIES.
YOU KNOW THE FTC HAS AN ONGOING
INQUIRY.
AND I WAS HEARTENED TO SEE
ASSEMBLYMEMBERS CUNNINGHAM
GALLAGHER MASON LACKEY RIGHT TO
CONGRESS NOT ONLY ABOUT THE
PREEMPTION ISSUE BUT ALSO ABOUT
THE NEED TO ADDRESS THESE --
COMPETITIVE ISSUES FOR A LARGE
TECH COMPANIES OF THIS ISN'T A
PARTISAN ISSUE AND WITHIN
CALIFORNIA SHOULD CONTINUE TO
LEAD THEIR THANKS VERY MUCH.
THANK YOU VERY MUCH NEXT
PANELIST PLEASE.
THE GERMAN SHALL AND COMMITTEE
MEMBERS --
MY NAME'S TODD WE AND I THINK
YOU'LL FIND TIME IN UNUSUAL
WITNESS HERE TODAY.
WELL MAYBE SITTING.
SIDE BY SIDE WITH SOME
IMPRESSIVE --
PRIVACY PROTECTION GROUPS I'M
HERE IS A CEO OF A GROWING
TECHNOLOGY COMPANY BASED IN
CALIFORNIA.
AND I'M HERE CALLING FOR MUCH
STRONGER CONSUMER PROTECTIONS --
STARTING WITH GIVING CONSUMERS
THE POWER TO OPT IN.
RATHER THAN OPT OUT OF SHARING
THEIR PERSONAL DATA.
I'M HERE TO TELL YOU IT'S TIME
FOR CALIFORNIA'S EXTRAORDINARY
TECH INDUSTRY. TO STOP
HARVESTING AND SHARING OUR MOST
PERSONAL PRIVATE DATA.
WITH WITHOUT OUR MEANINGFUL
CONSENT OR KNOWLEDGE.
I'M NOT HERE TO TELL YOU THAT AB
THREE SEVENTY FIVE OR STRONGER
PROTECTIONS ARE TOUGH TO
IMPLEMENT.
ST FILLED WITH WRONGDOERS
COMPLAINING.
THAT DOING RIGHT WILL PUT THEM
OUT OF BUSINESS ONLY TO COMPLY
AND THRIVE LEADER.
INCIDENTALLY THE SAME TECH
INDUSTRY COMPLAINED ABOUT
EUROPE'S GPR.
THAT CERTAINLY DID NOT PUT THEM
OUT OF BUSINESS.
I'M HERE TO TELL YOU THE NEW LAW.
OR STRONGER IS EASY TO
TECHNICALLY COMPLY WITH.
IF WE IF WE COMPANIES SIMPLY
BEGIN TO HONOR OUR CUSTOMERS
PRIVACY RIGHTS.
AND DESIGNER SERVICES TO BE
PRIVACY PROTECTING RATHER THAN
PRIVACY EXPLOITING.
I STARTED MY COMPANY PURISM.
WHEN I CAME TO REALIZE THAT MY
TWO YOUNG DAUGHTERS?
LIKE ALL CHILDREN.
NEED CONVENIENT PRODUCTS AND
SERVICES THAT PROTECT THEM.
RATHER THAN EXPLOIT THEM.
AS A TECHNOLOGIST.
I UNDERSTAND PAINFULLY WELL.
HOW MUCH THE TECHNOLOGY SECTOR
CAN EXPLOIT MY KIDS WITH THE
THIS?
THAT'S WHY STARTED THIS COMPANY
FOUNDED ON PRIVACY PROTECTION
PRINCIPLES.
PURISM IS ALREADY MANUFACTURING
IN CALIFORNIA AND ASSEMBLING
THESE LAPTOPS.
AND OPERATING SYSTEM
APPLICATIONS AND OF BUNDLED
SERVICES OUT OF ALL SAN
FRANCISCO IN CARLSBAD.
WE MANUFACTURING THIS YEAR
PRIVACY RESPECTING PHONE THE
BUNDLE SERVICES THE COMPLY WITH
AB THREE SEVENTY FIVE ALREADY.
AND GO EVEN FURTHER WITH OFTEN
BY DEFAULT FOR ALL OFFERED
SERVICES.
WE'VE BEEN GROWING TRIPLE DIGITS
ANNUALLY REFLECTING THE HUGE
BUILT UP CONSUMER DEMAND FROM
PARENTS AND PROFESSIONALS.
JUST LIKE YOU.
WHO SIMPLY WANT TO KEEP THEIR
AND THEIR CHILDREN'S LIVES
PRIVATE AND SECURE?
THIS IS DONE BY SIMPLE APPROACH.
THIS CALL PRIVACY BY DESIGN.
AS AB THREE TWENTY FIVE SIX TO
MAKE CLEAR PRIVACY IS A RIGHT.
AND YOUR EVERY LOCATION IN EVERY
COMMUNICATION AND EVERY WEB PAGE
AND EVERY SEARCH STORED
PERMANENTLY.
SHOULD NOT BE EXPLOITED. TO USE
NEEDED SERVICES ONLINE.
I STRONGLY SUGGEST THE TIME IS
COME FOR CALIFORNIANS TO TAKE
BACK THEIR CONSTITUTIONAL RIGHT
TO PRIVACY ON THE INTERNET.
AND URGE YOU TO SUBSTANTIALLY
STRENGTHEN THE PRIVACY
PROTECTIONS AFFORDED BY AB.
THREE SEVENTY FIVE FOR YOU AND
MY CHILDREN SAKE.
THANK YOU.
THANKS VERY MUCH AN NEXT
PANELIST PLEASE.
SO MANY SCOTT JORDAN I HIS
BACKGROUND I SERVED AS THE FCC'S
CHIEF TECHNOLOGIST FROM.
TWENTY FOURTEEN TO TWENTY
SIXTEEN THIS PART OF THAT I
WORKED ON THE FCC'S BROADBAND
PRIVACY ORDER.
I'M A PROFESSOR OF COMPUTER
SCIENCE I'M NOT A LAWYER WAS
HAPPY TO HELP YOU OUT ON TCPA
LAST YEAR.
AND OF THE CCB IS A GREAT START
AND WHAT I WANT TO DO TODAY.
ON THE GOALS OF TCPA.
OUR USERS TO BE ABLE TO HAVE
CHOICE.
AND WHAT I WANT TO DO IS I WANT
TO BRING THIS KIND OF BACK UP TO
THE TWENTY THOUSAND FOOT LEVEL
AND THINK BACK TO WHAT WE'RE OUR
GOALS HERE.
SO WE'RE GOALS WERE THAT USERS
HAVE CERTAIN EXPECTATIONS AND
SHOULD BE ABLE TO HAVE AN
EXERCISE YOUR CHOICES.
SO NOT START WITH A COUPLE OF
EXAMPLES SO LET'S SUPPOSE YOUR
USER OF GOOGLE MAPS.
AND YOU WANT TO BE ABLE TO GIVE
GOOGLE MAPS ACCESS TO YOUR
LOCATION FOR THE PURPOSE OF THE
FUNCTIONALITY THAT THE MAPS
GOING TO GIVE YOU FOR THAT.
TURN BY TURN DIRECTIONS.
BUT YOU DON'T WANT TO GIVE
PERMISSION FOR GOOGLE TO SELL
THAT INFORMATION OR SHARE THAT
INFORMATION TO SOME OUTSIDE
PARTY THERE WOULDN'T BE ABLE TO
TRACK IT.
SO COMPLETELY REASONABLE CHOICE
A LOT OF PEOPLE WOULD HAVE
SECOND EXAMPLE --
YOU HAVE YOUR I SP THAT YOU USE
TO ACCESS THE INTERNET AT HOME.
DAY YOU NEED TO GIVE THEM ACCESS
TO WHERE YOU WANT TO GO ON THE
INTERNET SO THEY CAN GET YOU
WHERE YOU WANT TO GO AND BRING
THE CONTENT BACK TO YOU.
IT MAY VERY WELL BE THAT YOU
DON'T WANT THEM OR EXPECT THEM
TO USE IT. TO DO ADVERTISING
THAT YOU SEE IS COMPLETELY
UNRELATED TO THE SERVICE TO
TRIPPING THE POOR.
SO WHAT IS THE RESEARCH I AM AN
ACADEMIC I GOT TO BRING THIS AND
SO THE RESEARCH SAYS CONSUMERS
LOOK AT IT GENERALLY IS A TRADE
OFF.
ACCESS TO CERTAIN OUT OF MY
PERSONAL INFORMATION WE'RE
REALLY FACING HIM WE'VE BEEN
FACING.
ON THIS ALL ALONG.
ONE OR USERS OFFERED MEANINGFUL
CHOICES CAN THEY EXERCISE
MEANINGFUL CHOICES OVER HOW MUCH
OF MY INFORMATION WHAT
FUNCTIONALLY DO I GUESS.
AND SECOND TO THE AT THE
INFORMATION THAT THEY NEED TO
DECIDE.
SO WHAT I WANT TO DO IS I WANT
TO VISIT THOSE AND SUGGEST A
COUPLE OF REFINEMENTS.
SO MANY START WITH USER CHOICE.
SO WE LOOK AT IT IS ESSENTIALLY
THREE BUCKETS AND PEOPLE BEEN
TALKING ABOUT IT BUT I JUST WANT.
TO ADD A LITTLE BIT OF INSIGHT
TO IT SO ONE BUCKET IS TERMS AND
CONDITIONS.
YOU HAVE TO AGREE TO A USE THE
SERVICE THE SECOND ONE IS OPT
OUT THE DEFAULT IS THEY CAN USE
IT BUT YOU CAN EXERCISE THE
CHOICE NOT.
TO THE THIRD ONE OUT TO THE
PEOPLE OF IN TALKING ABOUT.
SO THE QUESTION THE WORLD FACING
THE TEACHER STRUGGLING WITH THIS
WHICH BUCKETS APPROPRIATE FOR
WHAT KIND OF INFORMATION.
SO LET ME BRING IN WHAT WE KNOW
FROM RESEARCH SO WHAT WE KNOW IS
THAT USE YOUR EXPECTATIONS
DEPEND VERY MUCH IN THE CONTEXT
WHY WAS I GIVEN THIS INFORMATION
WHAT IS GOING TO BE USED.
FOR SO WHEN DATE IS USED IN
CONTEXT PARTICULARLY IT'S
REQUIRED TO OPERATE THE SERVICE.
THEN IT MAKES PERFECT SENSE THAT
IS IN THE TERMS AND CONDITIONS
ARE IS AN OPT OUT IT'LL COME
BACK TO THE DISTINCTION BETWEEN
THOSE.
BUT THEN THE RESEARCH SAYS IF
THE INFORMATION IS BEING USED
OUT OF CONTEXT.
THE USER WANTS TO BE ABLE TO
MAKE THAT TO SEE THE DECISION A
NEW MEANS.
I KNEW.
TAKING A LOOK AT WHAT
INFORMATION OF A PROVIDING AND
WHEN I GET BORED.
AND THAT TRANSLATES TALKED AND
SO WHATEVER COURAGE YOU IN
LOOKING AT THESE DEBATES THAT
YOU'VE BEEN HEARING ALL DAY
TODAY ON OFTEN VERSUS OPT OUT
VERSUS TERMS CONDITIONS. TO LOOK
AT IT IN THAT WAY IT'S WHAT WITH
THE USER EXPECTATION BE IN
CONTEXT SO A COUPLE OF EXAMPLES.
SO LET'S GO BACK TO THE I SP
EXAMPLE THEY NEED TO LOOK AT
WHERE I WANT TO GO ON THE
INTERNET IP ADDRESSES TO GET ME
THERE.
THAT'S PART OF THE SERVICE THEY
CAN'T DO IT WITHOUT IT VERY
NATURALLY I HAVE AGREED TO THAT
IN THE TERMS AND CONDITIONS.
THAT'S WHAT I'M PAYING THEM.
FOR BUT IF THEY WANT TO USE IT
FOR BEHAVIORAL ADVERTISING THAT
SHOULD BE A NEW DECISION.
THAT SHOULD BE OFTEN I CAN MAKE
THAT DECISION I LIKE THE RIVER
LABORATORIES AND OR I DON'T
PEOPLE DISAGREE ON THAT.
BUT THEY SHOULD BE ABLE TO MAKE
THAT DECISION SO WHAT DOES HE
CPA SAY ABOUT THIS.
SO WHAT IT SAYS IS IT'S AS IF
IT'S A BUSINESS PURPOSE OR DE
IDENTIFIED.
THEN IT'S PART OF TERMS
CONDITIONS MAKES PERFECT SENSE.
AND THEN IT SAYS IT'S NOT A
BUSINESS PURPOSE AND IT'S
IDENTIFIABLE PI MINUTES OPT OUT.
THE BUSINESS PURPOSE CONSTRUCT
IS A REALLY GOOD CONSTRUCT.
AND THERE'S A LANGUAGE IN THE
STATUTE IN CCPA THE RELATE SAID
CUT TO CONTEXT BUT WE'VE BEEN
TALKING ABOUT.
SO IT HAS THE RIGHT IDEA BUT I
WANT TO A FINE MAN.
LET'S GO BACK TO THE EXAMPLE OF
WHAT REALLY HAPPENED AND WE USE
THE I SP EXAMPLE ACCOUNT.
SO THE I. S. P.'S SEE WHERE I GO
ON THE INTERNET BECAUSE THEY
HAVE.
TO THEY CAN USE THAT TO CREATE A
PROFILE --
WHAT INTEREST I HAVE THEY CAN
THEN SELL AD PLACEMENT BASED ON
THE PROFILE?
INCLUDING GO TO BILLION THE
TWENTY SIXTEEN ELECTION RIGHT --
THEY WILL SAY THEY DON'T SELL
THE RAW DATA AND I BELIEVE THAT
THEY DON'T TELL THE RAW DATA BUT
THEY ARE ENABLING THIS BE HERE
FOREVER TIES IT IT'S OUT OF
CONTEXT.
SO I DON'T THINK IT'S ACCEPTABLE
THAT I DON'T HAVE AN OPTION TO
SAY YES OR NO TO THAT THAT'S A
NEW DECISION.
SO WHAT'S THE SOLUTION THE
SOLUTION IS WHAT A FEW OF THE
FOLKS TALKED ABOUT CCPA HAS IN A
CAN SENT OVER SHARING.
BUT EVERY OTHER PRIVACY
FRAMEWORK THAT WE'VE USED HERE
WHAT THE F. T. C.'S DONE WHAT
THE FCC'S DONE.
WHAT CHIEF YOURS DONE TALKS NOT
JUST ABOUT SHARING THE
COLLECTION AND USE I WANT TO
MAKE THE DECISION DO I WANT THEM
TO COLLECT THAT DATA?
AND HOW THEY'RE GOING TO USE IT
BASED ON WHAT FUNCTIONALITY I'M
GOING TO GO.
SO HOW DO YOU DO THAT --
WE SHOULD INCLUDE COLLECTION AND
USE IN THERE WHENEVER IT'S OUT
OF CONTEXT WHENEVER IT'S NOT
PART OF THE BUSINESS PURPOSE.
OKAY SECOND REFINEMENT.
HOW TO GET BACK INTO THIS OPTION
VERSUS OPT OUT?
SO THERE'S A BIG DIFFERENCE FROM
THE CONSUMER POINT OF VIEW.
BETWEEN EXAMPLE I'VE BEEN USING
AN I. S. P. USING RIGHT ON THAT
ARE FOR PEOPLE ADVERTISING AND
LET ME GIVE ANOTHER EXAMPLE.
SO SKYPE WHAT I USE SKYPE IT MAY
ONE ACCESS TO MY ADDRESS BOOK --
I MAY WANT TO SAY YES I MAY WANT
TO SAY NO I'M GONNA VIEW THAT
LIKELY ISN'T IN CONTEXT.
IT ONCE IT BECAUSE IF I GIVE IT
ACCESS I WON'T HAVE TO DIAL THE
NUMBER I CAN JUST PULL IT UP.
ON MIGHT MAKE A DECISION YES TO
MAKE IMAGES YOU KNOW PERSONALLY
I DON'T HAVE A PROBLEM WITH THAT
TOP DOWN [inaudible]
I THINK.
SCRIBE GOES A STEP FURTHER
CHOOSES TO MAKE IT UP.
TO BUT I WOULDN'T HAVE A PROBLEM
WITH THE BEING OPT OUT THIS IS
SOME CONTEXT.
SO I THINK YOU MAY BE ABLE TO
USE THAT TO GUIDE YOUR DECISIONS
COMING FORWARD ABOUT HOW TO
REFINE.
SO CONVINCED SUMMARY TERMS AND
CONDITIONS PERFECTLY APPROPRIATE
WHEN IT'S REQUIRED TO OPERATE
THE SERVICE I'VE AGREED TO IT
WHEN I SIGNED UP FOR THE SERVICE.
UP DOWN WHEN IT GIVES ME ADDED
FUNCTIONALITY BUT IT'S IN THE
CONTEXT OF WHAT EXPECT THIS CAP
OR SERVICE TO DO.
AN OPT OUT WHEN IT'S PART OF
CONTEXT AND SHOULD BE A NEW --
TO I WANT TO COME BACK TO THE
PART THAT I SKIPPED MY YOU'VE
SHOULD EXPECT ME TO DO FIRST IS
DO YOU WOULD HAVE THE
INFORMATION THAT YOU WANT.
IN ORDER TO MAKE THAT DECISION
TO MAKE THAT CHOICE.
SO CCPA ON USE TOOK A GOOD STEP
IT SAID YOU HAVE THE RIGHT TO
KNOW THE CATEGORIES OF
INFORMATION IS BEING COLLECTED
AND THE PURPOSES.
SO AN EXAMPLE AND I'LL COME BACK
TO THE I. S. P. AGAIN IF YOU
LOOK AT YOUR I. S. P.'S PRIVACY
POLICY.
IT WILL SAY SOMETHING LIKE THIS.
IT UP ONE SECTION THAT SAYS
INFORMATION WE COLLECT.
END OF A LONG LIST BUT ONE OF
THE THINGS IN THERE IS WHERE YOU
GO ON THE INTERNET.
ANOTHER THING IS GOING TO BE
YOUR ZIP CODE OF WHERE YOU LIVE.
THERE'S GONNA BE ANOTHER SECTION
OF THE PRIVACY POLICY THE TALKS
ABOUT HOW WE USE THE INFORMATION
IS COLLECTED.
AND ONE THING IN THERE IS GOING
TO BE TO ROUTE SURE TRAFFIC
WANTED OR THE NOTION OTHER.
IN ANOTHER ONE MAYBE IT IS VERY
LIKELY TO BE WE USE SOME OF YOUR
INFORMATION FOR ADVERTISING.
THIS IS ALL GOOD INFORMATION.
BUT WHAT YOU REALLY WANNA KNOW
IS IS MY I. S. P. USING WHERE I
GO ON THE INTERNET FOR
ADVERTISING.
I KNOW THE COLLECTING AT ANOTHER
USING SOMETHING FOR ADVERTISING
I REALLY WANT TO HEAR THE TWO
TOGETHER SO I CAN MAKE A
MEANINGFUL CHOICE OF SAY YES I
LIKE THAT OR NO I DON'T LIKE
THAT.
SO SOLUTION REFINEMENT THAT I'D
SUGGEST --
IN ADDITION TO WHAT TCPA DID OF
DISCLOSING CATEGORIES.
AND PURPOSES WE SHOULD PAIR THEM
TOGETHER THEY SHOULD DISCLOSE
THE PURPOSE FOR EVERY CATEGORY
THAT THEY COLLECT.
SO THAT AN ICE PICK AND SAY WE
USE WERE YOU GO ON THE INTERNET
FOR BEAVER ADVERTISING.
HORSE OF THE CAN SEE NOW WE
DON'T USE WHERE YOU GO ON THE
INTERNET PROVIDER TIES AND WE
JUST USE IT TO GET YOU WHERE YOU
WANT TO GO.
OKAY --
ANOTHER THING THAT I WANT TO
HEAR AN INFORMATION IS SHARED SO
CCPA AGAIN TAKES A GOOD STEP.
THAT SAYS YOU SHOULD KNOW THE
CATEGORIES INFORMATION THAT ARE
SHARED.
AND YOU SHOULD KNOW THE
CATEGORIES OF THIRD PARTIES THAT
IT SHARED WITH.
SO WE HAVE A SIMILAR PROBLEM
THAT WAS TOUCHED ON BEFORE.
IS YOUR I. S. P. IS LIKELY TO
SAY WE DO SHARE SOME KIND OF
INFORMATION DERIVED FROM WHERE
YOU GO ON THE INTERNET.
NOT THE RAW DATA BUT SOMETHING
THAT ALLOWS ADVERTISERS.
THEN WE SHARE YOUR ZIP CODE.
AND THEN A SEPARATE SECTION
THEY'LL SAY WE SHARE WITH
RESEARCHERS AND WE SHARE WITH
ADVERTISERS.
OKAY GREAT BUT WHAT I REALLY
WANT TO KNOW IS JUST BY I. S. P.
SHARED INFORMATION DERIVED FROM
WHERE I GO ON THE INTERNET WITH
ADVERTISERS.
OR THEY JUST SHARING OF THE
RESEARCHERS.
AS WAS MENTIONED EARLIER BIG
DIFFERENCE AND I MAY WANT TO SAY
YES TO ONE ANOTHER THE OTHER.
SO THAT'S ANOTHER REFINEMENT
THAT WE CAN TAKE IS TO SAY.
TELL ME THIS PARENTS.
TELL ME WITH WHO YOU SHARE WHAT
YOU SHARE WITH THEM.
I WANT TO BRIEFLY JUST HIT ON A
COUPLE OF OTHER ASPECTS --
THERE'S BEEN A LOT OF DISCUSSION
ABOUT INSPECTION AND DELETION --
I JUST WANT TO RE EMPHASIZE THAT
THIS IS ANOTHER WEEK PART.
THAT WE CAN IMPROVE.
IT SAID THAT WE HAD TO THE
INTENT THAT WE KNOW THAT MY
INFORMATION PROPAGATE SHOULD THE
ECO SYSTEM --
I'M NOT TRYING TO AVOID THAT BUT
IN ORDER.
TO EXERCISE MY RIGHTS I NEED TO
BE ABLE TO TRACK WHO DID IT GO.
TO IN I NEED TO BE ABLE TO TRACK
WHERE DID IT COME FROM.
AND THERE'S SOME GREAT EXAMPLES
OF HOW TO IMPLEMENT THAT.
BUT IF WE REALLY WANT USERS TO
BE ABLE TO EXERCISE THESE RIGHTS.
THEN WE NEED TO PROVIDE THEM
BOTH WHERE DID IT GO TO LIST
PARTIES.
AND WHEN I KNOW WHAT THIRD PARTY
HAS SOME OF MY INFORMATION.
WHERE DID IT COME FROM SAID I
CAN GO BACK TO TURN THE KNOB IF
I WANT TO SAY YES OR NO?
SO I CAN TURN THAT BACK OFF I
WANT TO TURN THEM BACK OFF --
ON THE COUPLE OF THINGS THAT
HAVE BEEN MENTIONED I'M NOT
GONNA HELP EXPLICIT ADVICE HERE.
BUT JUST TO BE ABLE TO INFORM
THE DISCUSSION.
THERE WAS DISCUSSION ABOUT THE
IDENTIFIED ABOUT ANONYMOUS ON
THE THE NEXT PANELIST WILL ADD
MORE DETAIL TO IT BUT I JUST
WANT TO GIVE YOU CONTEXT.
SO THE CONCEPT OF DE IDENTIFIED
THE TEST THAT YOU PUT IN C. C.
P. EIGHT IS THE RIGHT TEST.
YOU HAVE THE RIGHT LANGUAGE IN
THERE.
BUT I DON'T WANT YOU TO CONFUSE
WHERE THIS TECHNOLOGY CAME FROM
AND HOW IT'S BEING DISCUSSED.
IT CAME FROM HAVING DATA SETS
LIKE LIST OF HEALTH OUTCOMES YOU
KNOW A FIFTY SEVEN YEAR OLD MALE.
HAD THE FOLLOWING MEDICAL ISSUE
NO NAME NO IDENTITY ATTACHED.
GREAT BUT THIS DOES NOT APPLY TO
ADVERTISING ON THE INTERNET.
DON'T THINK THAT THAT THAT THAT
SHOWED UP.
ON LIKE CLAIMS YOU HEARD EARLIER
DON'T KNOW ANYTHING ABOUT WHO
YOU ARE.
THAT AND IN ORDER TO BE PLACED
ON THERE HAS YOUR I. P. ADDRESS
THAT CAN BE CONNECTED WITH ALL
KINDS OF INFORMATION ABOUT YOU.
IN THAT AD ITSELF CAN COLLECT
MORE INFORMATION.
BECAUSE IT HAS SOFTWARE CODE
BEHIND IT THEY CAN COLLECT MORE.
SO DE IDENTIFIED IS A GREAT
THING A BLIGHTED TODAY ARE JUST
I DON'T WANT YOU TO THINK THAT
THAT SOLVES THE ADVERTISING
ISSUES THAT A DISCUSSED.
WOULD HAVE TO ASK YOU TO WRAP UP
SLASH VERY LAST POP UP TO TAKE.
AND I JUST WANT AGAIN LEAVE YOU
WITH SOMETHING TO GO BACK AND
LOOK AT CAN DISCUSS IT MORE
LATER.
WHICH IS THERE SOME GREAT
EXAMPLES FROM COMPANIES THAT
YOU'VE HEARD FROM EVEN HERE.
FULL NAME SO --
APPLE GOOGLE THAT DON'T JUST
GIVE THESE BIG LONG LEGAL
PRIVACY POLICIES THESE DAYS THE
THE SECOND VERSION IT'S MEANT TO
BE REALLY.
USEFUL AND EASY TO UNDERSTAND
AND EVEN MORE IMPORTANT THAT HAS
EMBEDDED IN THEIR THE CONTROLS
RECKON TOWARD THINGS ON OR OFF.
AND THEY'RE GREAT EXAMPLES OF
WHAT WE SHOULD EXPECT SO TAKING
THE CHAIRMAN'S GUIDANCE FROM THE
BEGINNING.
THIS IS REALLY ALL THINGS WHERE
I THINK BOTH THE BUSINESS BICU
AND THE CONSUMER YOU FUTURE LINE.
THEY SHOULD WANT ME TO BE ABLE
TO MAKE THIS INFORMED CHOICES.
AND WE SEE SOME EXAMPLES BUT
THEY DO A GREAT JOB OF IT --
HAPPY TO ANSWER QUESTIONS AND
CONTINUE THE CONVERSATION THANKS
VERY MUCH IN NEXT PANELIST.
I APOLOGIZE WE CAN RUNNING --
SHORT ON TIME SO.
THANK YOU VERY MUCH FOR HAVING
ME.
ON WHEN IS ASH HUSTLE TINY I'M
INDEPENDENT RESEARCHER AND
CONSULTANT IN THE SPACE ABOUT
TWO DECADES OF EXPERIENCE WITH
PRIVACY AND SECURITY INCLUDING
BUILDING --
SECURED ARCHITECTURES FOR LARGE
FORTUNE FIVE HUNDRED COMPANIES
INCLUDING EIGHTEEN T. AND
GOVERNMENTS AT THE DEPARTMENT OF
HOMELAND SECURITY --
I WORKED AS AN INVESTIGATIVE
JOURNALIST LOOKING AT ONLINE
PRIVACY FOR A GOOD PART OF MY
CAREER AND HELP FIND.
EXAMPLES OF COMPANIES IS
ESSENTIALLY DECEIVING SEE
CHOICES FOR WHICH I WAS A
PULITZER FINALIST ALSO WORKED AS
A PRIMARY --
ONE OF THE FIRST TECHNOLOGIES A
TOUGH TO SEE AND WORKED UNDER
INVESTIGATION FOR GOOGLE
FACEBOOK AND TWITTER UNDER AND
THIS COMPUTER NOW UNDER CONSENT
AGREE AS A RESULT.
AND IT WORKED LEADERS THE CHIEF
TECHNOLOGIST FOR THE F. T. C.
LOOKING AT THEIR POLICY ON
EMERGING TECHNOLOGY AS WELL AS
AS AT THE WHITE HOUSE OFFICE OF
SCIENCE AND TECHNOLOGY POLICY ON
THEIR EMERGING TECHNOLOGY TASK
FORCE LOOKING A PRIVACY --
I THINK --
KIND OF IN SHORT.
I WANTED TO SUMMARIZE SOME OF
WHAT THE PALACE PUT PRIOR TO ME
SAID SAY AND WHILE THIS AREA IS
VERY COMPLICATED.
I THINK I DON'T THINK CCPA
ACTUALLY IS ALL THAT COMPLICATED --
IT'SA VERY NARROW POLICY
FRAMEWORK PERMITTING CALIFORNIA
CONSUMERS WERE CONCERNED ABOUT
PRIVACY. TO OPT OUT OF THE SALE
OF THEIR PERSONAL INFORMATION.
AND WHY THAT'S IMPORTANT IS IF
YOU LOOK AT THE CURRENT PRIVACY
FOR MARK IN THE U. S. WERE --
THE FTC'S AUTHORITY FOR EXAMPLE
UNDER SECTION FIVE WHICH GOVERNS
UNFAIR AND DECEPTIVE TRADE
PRACTICES.
IT'S OFTEN BASED ON WHAT
STATEMENTS COMPANIES MAKE TO
CONSUMERS AND WHETHER THOSE
STATEMENTS ARE DECEPTIVE. ONE OF
THE CHALLENGES WITH A FRAMEWORK
IS THAT AS OTHER PANELS OF
HIGHLIGHTED --
WHEN YOU INTERACT WITH A WEBSITE
YOU'RE ACTUALLY INTERACTING WITH
A NUMBER OF OTHER PARTIES AND
DATA BROKERS OR YOU KNOW AND --
ACT WITH A PHYSICAL STORE THEY
HAD IT ALL IRAQ WITH THOSE
NOTICES AND IT'S AWARE THAT --
THE FTC WILL GO AND FORCE UNDER
THESE THESE THIRD PARTY NOTICES
BECAUSE SOME ARGUE WHETHER THEIR
MATERIAL.
AS A RESULT OF CONSUMERS NOT
SEEING THAT.
RIGHT AND IF YOU CAN ONLY LOOK
AT THE TWENTY FOURTEEN FTC DATA
BROKE REPORT TO HIGHLIGHT SOME
OF THESE GAPS AND POLICY.
AND SO WHY THAT'S IMPORTANT IS
THAT THE CITY PAY FOCUSES ON
EXACTLY THESE THIRD PARTIES
ALLOWS CONSUMERS TO THE OPT OUT
OF THE SALE OF THESE INFORMATION
TO THESE THIRD PARTIES.
AND FOCUSES KIND OF OTHER
ENFORCEMENT REGIMES AROUND THE
FIRST PARTY INTERACTION WITH
STAFF TO SEE FOR EXAMPLE CAN
GOVERN I THINK QUITE WELL.
AND THIS PANEL AS AS IS DUBBED
KIND WHAT'S BEYOND TO CPA EVEN
DOT ONLY HEARD OF A NUMBER OF
OTHER ISSUES LIKE FACE
RECOGNITION GEO LOCATION.
A AYE INFERENCE BIAS ALL OF
THESE ARE --
SO PRIVACY ISSUES AND EVEN NOT
ONLY HEARD THAT CONGRESS AND
OTHER STATES ARE LOOKING AT THIS
WHAT I'M AFRAID IS THAT --
GIVEN THE COMPLEXITY OF THESE
ISSUES IN A NUMBER OF OTHER
TOPICS THAT FALL UNDER THE
PRIVACY AND BROTHER I'LL SUCH AS
A AYE BIAS.
WHAT WILL ULTIMATELY GET IN THE
U. S. AS A FRAMER IS GOING TO BE
A NOTHER KIND OF NOTICE AND
CHOICE FRAMEWORK THAT REQUIRES
CONSUMERS TO MAKE DECISIONS
ABOUT WHETHER THAT WAY COMPANIES
USE INFORMATION I SHARE THE
INFORMATION IS ADEQUATE?
AND I THINK WHY THAT'S
CHALLENGING AS AGAIN AS WE'VE
HEARD -- AN
A I CAN MAKE AN AND FRIENDS OR
KIND OF MACHINE LEARNING CAN
MAKE INFERENCES THAT THEY DIDN'T
UNDERSTAND.
SO I THINK IT'S A POINT TO THINK
ABOUT THIS PRIVACY LAW AND
ENOUGH IN THE IN THAT CONTEXT
WHERE WE MIGHT GET SOMETHING
DOWN THE PIKE BUT I THINK WHAT
WILK END UP GETTING IS MORE OF
THE SAME AND I DON'T THINK WE'LL
GET.
SOMETHING LIKE A EUROPEAN STYLE
SO WHAT THIS LOT PROTECTS AREAS
WHERE THE KERN FORCES DON'T HAVE --
A KIND OF A LOT OF AUTHORITY OR
DON'T HAVE A LOT OF
EFFECTIVENESS.
ON THE OTHER.
KRYCEKI'VE HEARD IS THAT --
THERE'S OF BIGNESS IN THAT CITY
PAY THE MAKES AN UNTENABLE
YOU'VE HEARD A NUMBER OF STRAW
MAN ARGUMENTS FOR EXAMPLE ON THE
AG REQUIRING COMPANIES TO
RESPONSE ON AUTHENTICATED.
USER REQUESTS RIGHT AND AND AND
GIVE OVER --
KIND OF INFORMATION CONSUMERS
THAT AREN'T WHO THEY REPORT TO
BE -- I
THINK THOSE COMMENTS ARE KIND OF
A LITTLE BIT IT --
DECEIVING AND AND NOT REALLY
EFFECTIVE DATE WE LEFT A LOT
HELPED WITH --
CONSOLE WITH --
MR TAGGART AND OF SPOKE THE RAGS
PRECISELY BECAUSE IT'S AN
INCREDIBLY TECHNICAL FIELD AND
IN THE COSTS INVOLVING SO.
LEAVING IT UP TO THE AG TO
DEFINE FOR EXAMPLE VERIFIABLE
USER REQUEST I THINK IS CRITICAL
AND THAT ALLOWS THE STANDARD TO
EVOLVE OVER TIME IN FIVE YEARS
WILL LIKELY NOT EVEN BE USING
USERNAMES PASSWORDS.
SO WHAT IT MEANS TO BE AN
AUTHENTICATED USER IS GOING TO
CHANGE OVER TIME AND YOU WANT TO
ALLOW THAT FLEXIBILITY.
RIGHT AT ROOM --
UNDERSTANDABLY COME COMPANIES
ARE CONCERNED THAT THOSE ROADS
AREN'T FURNISHED BUT I THINK --
I WOULD TRUST THE PETE THE GOOD
PEOPLE AT THE AG TO ACTUALLY GO
THROUGH AND AND THINK THROUGH
THESE HARD ISSUES AND PROVIDE --
SENSIBLE GUIDE THIS GUIDE AND
GUIDANCE AND ADDITIONALLY --
REGARDING THE GUIDANCE --
TO REGARDING THE CONCERNED BY
THE AGE OF HAVING TO RESPOND TO
CAN THE COMPANIES REQUEST FOR
DIRECT GUIDANCE I THINK IT'S
MERITED BUT I MIGHT SUGGEST
LOOKING AT THE FTC'S DCV THE
DIVISION OF CONSUMER AND
BUSINESS EDUCATION.
IN THE WAYS THEY PROVIDE PUBLIC
GUIDANCE AND HOW RESOURCE AND
MAYBE ONE A RESOURCE STAGE YOU
TO DO THIS BETTER BUT THEY ARE
ABLE TO PROVIDE PUBLIC GUIDANCE
IN AND AROUND THESE ISSUES LIKE
AN FAQ.
RATHER THAN DOING SPECIFIC
RESPONSES TO SEE --
FINALLY I THINK THE BIGGEST
POINT OF CONTENTION AND YOU'VE
HEARD A LITTLE BIT OF OF IT
TODAY TOUCHED --
IS AROUND THIS ISSUE OF SUIT
IDENTIFIERS AND AND WHAT IT
MEANS TO BE PERSONAL INFORMATION --
WE'VE HEARD A AND I'VE SEEN THE
CHAMBER IN OTHER LETTERS ARGUE
THAT PSEUDO IDENTIFIERS ARE
PSEUDONYMOUS TRACKING IS NOT
PERSONAL INFORMATION AND WHAT WE
MEAN BY PSEUDONYMOUS TRACKING IS
SOMETHING THAT'S NOT YOUR NAME
SO.
ASSIGNING JUST AN IDENTIFIER A
RANDOM STRING OF NUMBERS TO LIKE
YOUR SOCIAL SECURITY NUMBER IS A
PSEUDO IDENTIFIER RIGHT IT
REFERS TO UNIQUELY AND
IDENTIFIES A PARTICULAR CONSUMER
NOT A WOMAN IN THE ROOM BECAUSE
I WON IDENTIFY MAYBE FIFTY
CONSUMERS.
BUT WHEN IT GETS DOWN TO QUE OF
ZERO ONE WHEN IT DEFIES ONE
PERSON THAT'S ACTUALLY WHAT
WE'RE TALKING ABOUT.
AND ANOTHER ANOTHER KIND OF
SOMETIMES IDENTIFIERS ARE
RANDOMLY ASSIGNED LIKE ONE TWO
THREE FOUR SOMETIMES AND MORE
OFTEN THE THE WAY --
KIND OF THAT THE DATA BURKE
INDUSTRY WORKS IS THAT BASED ON
WHAT ARE KNOWN AS HASHED
IDENTIFIERS AND A HASH IS JUST A
MATHEMATIC MATHEMATICAL
TRANSFORMATION OF A SET OF
NUMBERS ARE CHARACTERS.
SO IF YOU'RE MEMBER --
CRACKER JACKS LITTLE ROTATOR
RING AN OLD CRACKED CRACKER
JACKS --
THAT --
BOXES WHERE YOU COULD SEE
CLEARLY COMMUNICATE WITH YOUR
FRIENDS THOUSAND EXAMPLE OF THE
WEEK CASH WAS CALLED A ROTATION
HASH OF ONE SO --
HAD CHAO FOR EXAMPLE WOULD BE
SOME AND I CAN REFER TO YOU AS
THAT AND AND NIKKI COULD REFER
TO IS THAT WE CAN SHARE
INFORMATION ABOUT YOU LIKE YOUR
BROWSING HISTORY OR WHAT STORIES
YOU'VE BEEN TO AND NEVER REFER
TO BY NAME.
BUT IT IS EFFECTIVELY A SERVING
THE SAME PERSON AT THE SAME
PURPOSES REFERRING TO BY NAME I
THINK IT'S CRITICAL TO MAKE SURE
THAT -- HE'D
NEED DON'T SWEEP AND SIT ON
SYNONYMOUS TRACKING AS AN
EXEMPTION LIKE YOU DO DE
IDENTIFIED DATA BECAUSE THEY
MEAN TWO DIFFERENT THINGS THE
THE PRIMARY WAY THAT THE
INDUSTRY EXCHANGES DATA FOR
EXAMPLE WHEN.
YOU GO INTO --
CVS AND PURCHASE A RAZOR BLADE
AND BETA USING YOUR LOYALTY CARD
AND FACEBOOK IS THAT ABLE TO
REPORT WHAT PERCENTAGE OF PEOPLE
SAW.
HAD FOR RAZORBLADE WALKED IN AND
BOUGHT THE RAZOR BLADE WHICH IS
A SERVICE THAT THEY OFFER
THROUGH THE SERVICE HOW THE
LOGICS IT'S DONE THROUGH THE
SUIT DENTIFIERS USUALLY.
A PSEUDONYM OR A HASH OF YOUR
EMAIL.
RIGHTS I THINK IT'S CRITICAL --
TO TO MAKE SURE THAT THAT
DOESN'T GET SWEPT UP AS AN
EXEMPTION.
AND THEN FINALLY I THINK THE THE
I WANT TO THANK YOU AND I'M
HONORED TO AND I NOTE A BIT OF
TECHNOLOGY [inaudible]
INTEREST THE SOPHISTICATION OF
ONLINE TRACKING AND THE
SOPHISTICATION OF DATA EXCHANGES --
ARE ARE MORE AND MORE --
INCREASINGLY TECHNICAL I THINK
IT'S IMPORTANT HAVE KIND OF
TECHNICAL AS AN ADDITION TO
LAWYERS AND POLICY MAKERS
HELPING YOU SIFT THROUGH THESE
THINGS AND SO THANK YOU FOR
INVITING ME.
THANK YOU VERY MUCH AND NEXT
PANELIST PLEASE.
THANK YOU AGAIN MISTER CHALLEN
MEMBERS I'LL BE BRIEF --
GIVEN THE TIME I JUST THINK
SERRA BOAT WITH CAL CHAMBER
[inaudible]
JUST.
REALLY WANT TO MAKE SURE THAT WE
DON'T LOSE SIGHT OF THE FACT
THAT WE LITERALLY PASSED WHAT
HAS BEEN DUBBED THE MOST ROBUST
PRIVACY LAW IN THE COUNTRY --
IT STILL HAS ISSUES THAT NEED TO
BE SORTED THROUGH IT STILL HAS
REGULATIONS THAT NEED TO BE
COMPLETED REGULATIONS THAT WE
HOPE MIGHT OFFER BUSINESSES OF
ALL SIZES ACROSS ALL INDUSTRIES
SOME GUIDANCE ON HOW TO COMPLY
WITH THIS VERY COMPLEX LOG --
IT'S GOING TO BE VERY EXPENSIVE
FOR BUSINESSES TO COMPLY WITH
THIS LINE AS WE DISCUSSED IT'S
GONNA INCLUDE GROCERY STORES
RESTAURANTS ALL KINDS OF OTHER
BUSINESSES INCLUDING BUSINESSES
WITH VERY SLIM PROFIT MARGINS.
WE'VE YET TO SEE THE IMPACT OF
THE CPA ON STATE'S ECONOMY.
WE'VE YET TO SEE JUST HOW MANY
HOW MUCH.
pTHIS LAW WILL RAISE PRICES FOR
CONSUMERS AND WHAT IS ALREADY A
VERY INCREDIBLE STATE EXPENSIVE
STATE.
THERE ARE CRUCIAL FACTORS THAT
NEED TO BE WEIGHED BY
CALIFORNIANS BEFORE WE ADD EVEN
MORE ONEROUS REQUIREMENTS ON TOP
OF THE CPA.
ALREADY TOUCHED ON THIS EARLIER
SO I'LL JUST MENTION IT BRIEFLY --
HERE.
ADDING A PRIVATE RIGHT OF ACTION
TO ENFORCE THIS SEATING FOR
CALIFORNIA BUSINESSES AND FOR
OUR ECONOMY.
SO.
WHEN WE THINK ABOUT WHAT IS THE
FUTURE WITH RESPECT TO PRIVACY
HERE IN CALIFORNIA IT'S FIXING
THE CZ P. A. R. WORK IS NOT DONE
WE NEED TO MAKE SURE IT'S
WRITTEN IN A WAY THAT BUSINESSES
CAN ACTUALLY COMPLY WITH IT?
AND WE NEED TO MAKE SURE THAT WE
SET UP.
CALIFORNIA BUSINESSES FOR
SUCCESS TO BE ABLE TO COMPLY
WITH IT --
THE NEXT PANELIST --
MISS FOR SHADE WAS A PRIVACY LAW
COMPLIANCE EXPERT IS PROBABLY
GONNA RESPOND TO SOME POINTS
REYES AND SHE'S ALSO GOING TO
PUT INTO PERSPECTIVE FOR
EVERYONE.
KNEW JUST WHAT CALIFORNIA
BUSINESS IS GOING TO HAVE TO GO
THROUGH TO COMPLY WITH THIS LOT.
AND I WANT.
MEMBERS I ASK MEMBERS TO RECALL
THAT THE THE HANDFUL OF THE TECH
GIANT'S AT A MET BEEN MENTIONED
OVER AND OVER AGAIN ON THIS
PANEL.
COMPRISE JUST A FRACTION OF THE
BUSINESSES THAT MUST COMPLY WITH
THIS LONG WE ASK YOU TO PLEASE
KEEP IN MIND ALL OF THE
DIFFERENT INDUSTRIES THE MID
SIZE THE SMALLER COMPANIES ARE
GOING TO HAVE TO COMPLY.
WITH THIS LAWS WHEN IT COMES
INTO EFFECT CAR DEALERS REAL
ESTATE AGENTS RESTAURANTS I MEAN
THERE'S SO MANY DIFFERENT TYPES
OF BUSINESSES THAT NEED TO BE
TAKEN INTO CONSIDERATION AND WE
ASK THAT YOU KEEP THAT IN YOUR
MIND AS WE MOVE FORWARD IN THIS
PROCESS THANK YOU SO MUCH.
TIME.
THANK YOU VERY MUCH.
NEXT POINT PANELS PLEASE.
THANK YOU MISTER CHAIR AND
MEMBERS -- I
WANNA KEEP THIS BRIEF GUIDE.
I HOPE THIS WORKS [inaudible]
FIVE LISTEN I THINK ULTIMATELY
WE DON'T DISAGREE ABOUT A LOT OF
THE OBJECTIVES HERE RATE --
THE IMPORTANCE OF THE CALIFORNIA
CONSTITUTIONS RIGHT TO PRIVACY
I'D LIKE TO SAY I'M A CONSUMER.
TO I HAVE CHILDREN AND I'M
REALLY GLAD THAT I'M HERE IN
CALIFORNIA AND THAT I'VE BEEN
PROTECTED BY THE CALIFORNIA IF
OF PRIVACY.
RIGHTS UNDER THE CONSTITUTION
ACTUALLY SINCE I WAS BORN WERE
THE SAME AGE I'M PROUD THAT I'VE
GROWN UP WITH IT OKAY.
I'M GLAD THAT MY KIDS ARE
PROTECTED BY CALIFORNIA LAW
EXISTING CALIFORNIA LAW THE
GIVES MINERS THE RATE TO GET
THEIR INFORMATION REMOVED FROM --
SERVICES ONLINE I AM REALLY --
IMPRESSED WITH THE SHINE THE
LIGHT LAW AND I THINK IT GIVES
CONSUMERS ACTUALLY PEOPLE
DISAGREE WITH ME BUT I THINK
IT'S CONSUMERS QUITE ROBUST
RIGHT. TO EXERCISE CERTAIN
CHOICES I AM SURPRISED THAT
CONSUMERS DON'T DO IT MORE OFTEN
THAN THEY DO AND I KNOW BECAUSE
I RESPOND TO THOSE REQUESTS WHEN
MY CLIENTS GET THEM.
IN MY COLLEAGUES TO COMPLY WITH
THE SHINE THE LIGHT LAW SO I
DON'T KNOW WHAT OTHER PEOPLE ARE
DOING BUT WE'RE TRYING TO COMPLY
WITH EXISTING LAW.
THERE'S ALSO EXISTING LAWS THAT
PROTECT AGAINST THE KIND OF
DISCRIMINATION THAT YOU'VE BEEN
HEARING ABOUT IN HOUSING AND
EMPLOYMENT IN LENDING IN
INSURANCE UNDER THE FAIR CREDIT
REPORTING ACT UNDER THE EQUAL --
EMPLOYMENT ACT FEDERAL LAWS ALSO
STATE LAWS THAT THAT ARE PROTECT
EMPLOYEE EMPLOYEES IN CALIFORNIA
THERE'S A LOT OF LAWS THAT
ALREADY GIVE CALIFORNIANS A LOT
OF PROTECTION AND RIGHTS.
IS THERE A SAID.
THIS IS A BROAD BASED LAW THAT
HITS THE ENTIRE CALIFORNIA
ECONOMY YOU KEEP HEARING THE
SAME NAMES OVER AND OVER AGAIN.
GOOGLE FACEBOOK DATA BROKERS
TECH BIG TACK THAT'S WHAT WE'RE
TALKING ABOUT THERE'S THIS HUGE
OFF IN THE ROOM THE NOBODY'S
TALKING ABOUT WHICH IS THAT
THEY'RE ALL THESE BUSINESSES.
THEY'RE IMPACTED.
THE DEBT IS NOT THE SUBJECT OF
THE CONVERSATION THAT WE'RE
HAVING TODAY MANY OF THOSE
CONSUMER FACING BUSINESSES WHO
ARE THE ONES CURRENTLY
RESPONSIBLE FOR GIVING THOSE
RIGHTS THOSE NOTICE AND CHOICE
RIGHT.
THEY'RE THE ONES WHO DON'T EVEN
KNOW A LOT OF THE TIME WHAT'S
GOING ON IN THE BACKGROUND AND
SO HOW CAN YOU POSSIBLY ASKING
THEM. TO COMPLY WITH ALL THESE
ADDITIONAL REQUIREMENTS TO
DISCLOSE INFORMATION WHEN THEY
DON'T KNOW WHAT THE REST OF THE
ECOSYSTEM IS DOING.
ITS AN ECOSYSTEM ADVERTISING
TECHNOLOGY IS AN ECOSYSTEM.
I WANT TO GET MY NEWS NOT JUST
FROM GOOGLE AND FACEBOOK I WANNA
GET MY NEWS FROM ALL KINDS OF
PUBLISHERS BUT THEY ARE ALL
CONNECTED TO THE SAME AD TECH
ECOSYSTEM WHICH IS IMPACTED BY
THIS LAW.
AND SO YOU'VE TOO MANY PLAYERS
WHO DON'T KNOW HOW TO COMPLY
WITH ALL THESE INCONSISTENT
OVERLAPPING REQUIREMENTS THAT
ARE NOT TAILORED TO THE
INDIVIDUAL PLAYERS IN THE SYSTEM.
DOESN'T HAVE TO BE TECHNOLOGY
BASED BUT DOES AFTER WRECKING
THIS ECOSYSTEM.
SO.
IF YOU WANT US TO BE ABLE TO DE
IDENTIFY DATA.
THEN TELL US WHAT THAT MEANS AND
IT'S NOT FAIR TO SAY YOU CAN DE
IDENTIFY THE DATA AND HOW WOULD
BE NOT PERSONAL INFORMATION IF
YOU THEN TURN AROUND AND SAY WE
CAN'T REALLY DE IDENTIFIED WITH
THE TECHNOLOGY THAT EXISTS TODAY.
BECAUSE THAT SEEMS LIKE YOU'RE
SAYING IT'S ALL PERSONAL
INFORMATION AND THERE'S NO WAY
TO DO IT.
BY DE IDENTIFICATION.
PRIVACY IS GOOD FOR BUSINESS AND
BUSINESSES ARE WORKING REALLY
HARD UNDER EXISTING LAW ON BEST
PRACTICES TO DO RIGHT BY
CONSUMERS.
THERE ARE EXISTING CHOICES UNDER
THE NA I AND AD CHOICES SELF
REGULATORY FRAMEWORKS USERS CAN
IN FACT ALREADY CHOOSE NOT TO BE
TRACKED BY THIRD PARTIES ON
WEBSITES.
THAT EXISTS THEY JUST HAVE TO
CLICK THROUGH TO THOSE OPTIONS
THERE'S A LITTLE ICON ON THE
THIS IN ORDER TO ADDRESS THOSE
CONCERNS ABOUT THE PLAYERS
BEHIND THE SCENES IS IT PERFECT.
NO MOST THINGS AREN'T.
BUT THERE ARE OPTIONS IN PEOPLE
SHOULDN'T BE TOLD THEY DON'T
HAVE OPTIONS BECAUSE THEY DO.
SO -- THERE
IS ALREADY AS WELL AS BEEN
MENTIONED FEDERAL TRADE
COMMISSION GUIDANCE ON DATA
BROKERS AND HAD DATA BROKERS CAN
WORK TO DE IDENTIFY INFORMATION
AND TO PROVIDE DIRECT CHOICES TO
CONSUMERS AND THAT'S WHY
COMPANIES LIKE AXIOM ALREADY DO
THAT.
AND PROVIDE INFORMATION ON THEIR
WEBSITE EVEN THOUGH THEY'RE NOT
CONSUMER FACING IN ORDER THE
CONSUMERS CAN OBTAIN THAT KIND
OF INFORMATION.
WHERE WE GOING IN THE FUTURE
WHAT DOES THIS MEAN --
IT IT IS ABSOLUTELY TRUE THAT
THIS YEAR AND PROBABLY FOR MANY
YEARS TO COME YOU'RE GONNA SEE
CALIFORNIA BUSINESSES.
SPENDING THEIR TIME AND THEIR
MONEY TRYING TO UNDERSTAND HOW
TO IMPLEMENT THIS LAW TRYING TO
FIGURE OUT WHERE ALL THIS DATA
IS AND REMEMBER IT'S ALL THE
DATA.
CONNECTED WITH CONSUMERS
CONNECTED WITH HOUSEHOLDS
THEY'RE GOING TO HAVE TO ASSUME
IT CAN BE IDENTIFIED IF THE
DEFINITION IS CAPABLE OF BEING
IDENTIFIED CAPABLE OF BEING
ASSOCIATED WITH.
AND I WANT TO KNOW BECAUSE I SAW
IT SOMEWHERE AND I JUST WANNA
MAKE SURE THAT I NOTED THAT DOES
NOT COME OUT OF EXISTING
CALIFORNIA LAW.
THERE IS SEVENTEEN NINETY EIGHT
POINT I THINK IT'S EIGHT OH OR
SOMETHING LIKE THAT THAT'S BEEN
SIGHTED IN SOME THE MATERIALS
THAT RELATES TO THE DISPOSAL Là
UNDER CALIFORNIA LAW.
THAT DEFINITION THAT BROAD
DEFINITION OF PERSONAL
INFORMATION CAPABLE OF BEING
ASSOCIATED WITH THAT ONLY
RELATES TO DATA DISPOSAL IT IS
NOT AN EXISTING LAW.
IT IS NOT CONNECTED TO FOR
EXAMPLE THE BREACH NOTIFICATION
LAWS WERE SHINE THE LIGHT LAW OR
ANY OF THOSE OTHER THINGS SO I
JUST WANTED TO SPELL THAT MATH.
THIS IS GONNA BE A HUGE
UNDERTAKING FOR CALIFORNIA
BUSINESSES.
THE PEOPLE WHO WORK FOR THOSE
BUSINESSES THOSE ARE THE SAME
CONSUMERS WERE TRYING TO PROTECT
SO THEY ARE BOTH CONSUMERS.
WHO WE DO NEED TO PROTECT I WANT
TO CHECK MY KIDS MY PARENTS
PEOPLE DON'T UDERSTAND THE
TECHNOLOGY AS WELL I WANT TO
EDUCATE CONSUMERS ON WHAT THEIR
EXACT EXISTING RATES ARE?
BECAUSE WE SHOULD BE DOING THAT.
AND DO THAT THE CALIFORNIA
OFFICE OF PRIVACY PROTECTION
THAT USED TO EXIST DOESN'T
ANYMORE DID A FANTASTIC JOB OF
PROVIDING GUIDANCE TO BUSINESSES
AND CONSUMERS.
WE SHOULD DO THAT.
BUT WE ALSO REMEMBER THOSE
PEOPLE OF DROPS IN THE
BUSINESSES THAT ARE IMPACTED BY
THIS LAW AND WHO ARE GOING TO
HAVE.
TO TURN THEMSELVES UPSIDE DOWN
POSSIBLY GO OUT OF BUSINESS IF
THEY GET STUDENT TO THE PRIVATE
RIGHT OF ACTION. FOR NOT HAVING
QUOTE REASONABLE SECURITY WHEN
THEY CAN'T EVEN ACCOMPLISH THAT
AND THEY GET STUCK WITH A
FISHING ATTACK.
THOSE PEOPLE GONNA LOSE THEIR
JOBS BECAUSE OF COMPANIES ARE
GONNA GO OUT OF BUSINESS OR
THEY'RE NOT GONNA BE ABLE TO DO
WHAT THEY NEED TO DO THEY'RE
GONNA HAVE TO RE ASSIGN
RESOURCES JUST TO DEAL.
WITH THE CCPA EVEN IN ITS
CURRENT FORM.
SO LET'S USE THE OPPORTUNITY
THAT WE HAD TO GET IT RIGHT. TO
TELL PEOPLE ABOUT THE RIGHTS THE
ALREADY HAVE UNDER EXISTING LAWS
TO MAKE THIS THE BEST POSSIBLE.
LEADING STATE LAW IN THE NATION.
WHICH IT SHOULD BE WITHOUT
DAMAGING THE ENTIRE CONTENT.
THANKS VERY MUCH.
DO YOU HAVE A REAL QUICK WITHOUT
GET COULD JUST DON'T MAKE MAKE A
QUICK COMMENT ON THIS POINT
REGARDING SMALL BUSINESSES AND
MOM AND POP STORES.
SO SO.
IN TODAY'S AGE IT'S RARE TO HAVE
A BUSINESS THAT MEETS THE
THRESHOLD THAT DOESN'T HAVE SOME
ONLINE PRESENCE OF SOME SORT AND
MORE AND MORE.
ON AYE COMPANIES ARE USING WEB
HOSTING CLOUD HOSTING EITHER
AMAZON WEB SERVICES GOOGLE.
GOOGLE CLOUD OR EVEN SQUARE
SPACE OR OR WORDPRESS OR SOME
SUCH THING AND OFTENTIMES ALL OF
THESE COMPANIES ALSO GO THROUGH
THE PROCESS OF WORKING WITH
ANALYTICS COMPANIES.
THIRD PARTY DATA BROKERS SO IT'S
NOT JUST THE BIG TECH COMPANIES
RIGHT IN A STUDY THAT I DID IN
TWO THOUSAND EIGHT WE FOUND THAT
GOOGLE WAS PRESENT ON 88% OF THE
FOUR FIVE OR THOUSAND SITES WE
SURVEYED.
ON THE INTERNET AT THAT TIME AND
THAT NUMBER IS GROUND RIGHT SO
IT'S SO IT'S SO WHILE WE WE AND
I HAD ACTUALLY USE THE SHINE THE
LIGHT NIGHT LIGHT LAW.
AND I'VE WRITTEN LETTERS TO
COMPANIES AND I'D RESPONSIBILITY
SUB THIS KIND OF IN THE NON DATA
SPACES YOU WOULD CALL IT STILL
IN THE BUSINESS OF PURCHASING
DATA ABOUT THE CONSUMERS.
PURCHASING MEANINGLESS USING
CLOUD HOSTING USING ANALYTICS SO
THAT'S IMPORTANT TO MAKE SURE
THAT THAT --
OF THE COMPANIES THAT THAT ARE
AFFECTED THOSE ARE ACTUALLY IN
FACT THE ONES THAT ARE FEEDING
DATA INTO INTO THE SPEAKER
SYSTEM I REMEMBER IN THE SAME
TWO THOUSAND EIGHT STUDY WE
LOOKED AT ONE OF THE BIG DATA
BROKERS.
AT THE TIME AND WHERE THEY WERE
PURCHASING INFORMATION THERE WAS
A WOMAN WHO KEPT APPEARING ON
ONE OF THESE LISTS EVEN THOUGH
SHE WAS ON THE DO NOT CALL AND
SHE WAS ON A WITNESS PROTECTION
LAST.
RIGHT HAND --
SEE -- SEE
PO OF THE OF THE COMPANY TOLD US
AT THE TIME THAT THEY WERE
PURCHASING DATA FROM A LOCAL
PIZZA CHAIN.
SO PIZZA CHAIN THAT WAS --
IS --
NATIONAL PIZZA CHAIN BUT THEY
WERE GETTING THE DATA FROM THE
LOCAL --
PIZZA --
KIND OF PIZZA SALES --
DELIVERY COMPANY BECAUSE THAT'S
A GREAT SO I THINK I THINK.
THAT IT IS A PRECISELY THE AREA
WE WANT TO KIND OF MAKE SURE IS
COVERED NAY SICK AGAIN FOR
COMPLIANCE SINCE MANY OF THIS
THAT THE COMPANIES ARE GOING TO
CLOUD HOSTING CLOUD SERVICES I
THINK THOSE CLOUT SERVICES WILL
ALSO PROVIDE THE TOOLS.
PROVIDED TECHNOLOGIES PROVIDE
TECHNOLOGIES LIKE OUR FELLOW
PANELISTS TO HELP COMPLY SO I
JUST WANT TO MAKE THAT POINT
BECAUSE I DON'T THINK IT'S JUST
ABOUT BUT TECH.
THANK YOU VERY MUCH IF THERE ARE
NO FURTHER COMMENTS I WANT TO
THANK ALL THE PRESENTERS FOR
BEING HERE TODAY AND WE GONNA
TURN TO PUBLIC COMMENTS SO
THANKS VERY MUCH. FOR BEING HERE.
SO FOR PEOPLE WHO LIKE TO MAKE
COMMENTS PLEASE --
LOOK ALIGNED ABOUT BEHIND A MIKE
AND IF I COULD ASK YOU TO LIMIT
YOUR COMMENTS TO MAYBE NO MORE
THAN TWO MINUTES --
IN THE INTEREST OF TIME OF WHAT
AND IDENTIFY YOURSELF AND YOUR
POSITION IN POLICE BEGIN.
THANK YOU MISTER CHAIRMAN I'LL
TRY TO LIMIT IT TO ONE MINUTE
HOW ABOUT THAT MY NAME IS I WORK
CHRIS OSWALD.
I REPRESENT TWO THOUSAND
BUSINESSES SERVICE PROVIDERS AND
NONPROFITS THEY COMPRISE THE
ASSOCIATION OF NATIONAL
ADVERTISERS.
NEARLY EVERY AD YOU'LL SEE OR
HEAR IS CONNECTED IN SOME WAY TO
AIN ETS MEMBERS ACTIVITIES IN
CALIFORNIA ADVERTISING HELPS
GENERATE. SEVEN HUNDRED AND
SIXTY SEVEN BILLION DOLLARS AND
HELPS PRODUCE TWO POINT SEVEN
MILLION JOBS.
THE A IN A WE SO STRONGLY
SUPPORT THE UNDERLYING GOALS OF
THE C. CPA PRIVACY IS
EXTRAORDINARILY IMPORTANT VALUE.
THAT DESERVES MEANINGFUL
PROTECTIONS IN THE MARKET PLACE
WE'RE CONCERNED THAT SOME
ASPECTS OF THE CCPA HOWEVER
WHILE WELL INTENTIONED.
WILL HAVE UNINTENDED
CONSEQUENCES FOR CONSUMERS
BUSINESSES NONPROFITS AND
ADVERTISERS THAT WILL
INADVERTENTLY UNDERMINE RATHER
THAN ENHANCE CONSUMER PRIVACY.
WE OFFER TO WORK WITH YOU AND
THE REST OF THE COMMITTEE AND
OTHERS -- TO
ADDRESS THESE CONCERNS IN A WAY
THAT UNDERMINE CONSUMER
PROTECTIONS.
BUT RATHER INSURERS IT BUT IT
BUT PROMOTES THEM AND CHORES
CLEAR RULES FOR BUSINESSES.
SPECIFICALLY I WANT TO HIGHLIGHT
THE FOLLOWING FOR INITIAL ISSUES
BECAUSE THEY REPRESENT THE
HIGHEST LEVEL OF CONCERN FOR OUR
MEMBERS NUMBER ONE THE CCPA
FORCES BUSINESSES. TO TURN
PSEUDONYMOUS DATA INTO
IDENTIFIABLE INFORMATION IN
ORDER TO EFFECTUATE CONSUMER
RIGHTS.
THIS UNDERMINES CONSUMER PRIVACY
NUMBER TWO THE CCPA FACILITATES
UNAUTHORIZED ACCESS TO CONSUMER
DATA BECAUSE IT TREATS
HOUSEHOLDS AS A SPECIFIC
CONSUMER PROVIDING ACCESS. TO ON
AUTHORIZED INDIVIDUALS.
NUMBER.
THREE THE ACT FAILS TO PROVIDE
OTHER EFFECTIVE MEANS TO OFFER
EXPLICIT NOTICE FOR THE SALE OF
DATA TO A THIRD PARTY.
RESTRAINING THIRD PARTY DATA
MARKET THEREBY REDUCING
COMPETITION IN THE MARKET PLACE.
TO THE DETRIMENT OF CONSUMERS.
AND FOURTH THE CCPA FORGOES
CONSUMERS OPTIONS FOR NUANCED
AND TAILORED DELETION AN OPT OUT
CHOICES.
ALL OR NOTHING OPTIONS DEPRIVE
CONSUMERS CONTROL OVER AND
BENEFITS DERIVED FROM THEIR DATA.
I'LL BE SUBMITTING A LETTER TO
THE COMMITTEE FOR THE RECORD
WITH MORE DETAIL ON ALL OF THESE
POINTS.
LOOK FORWARD TO WORKING WITH YOU
THE COMMITTEE AND OTHERS THANK
YOU VERY MUCH TAKES ARE NICE
PLACE.
GOOD MORNING MY NAME IS JEFF ERA
MáS BEING FROM A COMPANY CALLED
ALL CLEAR OUR FOCUS IS AND
EXPERTISE IS AN IDENTITY THEFT
PROTECTION IDENTITY REPAIR.
AND DIGITAL ID'S.
DIGITAL IDENTIFICATION PROVIDES
BOTH A HIGH DEGREE OF PERSONAL
DATA SECURITY AND INCREASED
CONSUMER CONVENIENCE.
IT IS PROVEN INVALUABLE FOR
AMONGST OTHER THINGS VERIFYING
IDENTITIES FOR BUSINESSES IS A
RESPOND TO PERSONAL DATA ACCESS
REQUEST UNDER THE GPR IN THE E.
U..
WE ENCOURAGE YOU TO CLEAR A PATH
SUCH THAT RESPONSIBLE THIRD
PARTY DIGITAL ID COMPANIES CAN
BE PART OF THE SOLUTION TO THE
CHALLENGES THAT YOU'RE FACING
WITH THE IMPLEMENTATION OF THE
CCPA HER IN CALIFORNIA.
THANK YOU VERY MUCH THANK YOU
VERY MUCH AND NEXT PLEASE.
HI MY NAME IS ANDREW LACK MEN I
AM AN ATTORNEY --
AND ACTUALLY I RAN FOR ASSEMBLY
THE SAME TIME YOU DID YOUR FIRST
ELECTED ASSEMBLYMAN CHALLENGE --
HAPPY TO SEE YOU UP HERE --
A RED ISSUE --
I AM CURRENTLY TECHNOLOGY
ATTORNEY IDEA WITH DATA PRIVACY
ALL OF MY CLIENTS HAVE LESS THAN
TWENTY FIVE EMPLOYEES --
THEY RANGE FROM CONTENT
MANAGEMENT TO BUSINESS
INTELLIGENCE --
AND BEFORE THIS I WORK FOR
CONGRESSMAN TED LEWIS IS
LEGISLATIVE DIRECTOR DEALING
WITH TECHNOLOGY INDUSTRIES LIKE
THE TECHNOLOGY I GOT INVOLVED
BECAUSE OF THE NEED. TO BRIDGE
THE GAP BETWEEN PRACTICE AND
POLICY -- I
I REALLY APPRECIATE CCPA TO SOME
WONDERFUL THINGS --
AND IT IS BY FAR --
I THINK IMPROVE AND BILLS IN A
COUPLE AREAS SUCH AS DATA SALES
WHICH IMPORTANT.
BUT WHAT HAPPENS IF YOUR CLIENT
DOES NOT SELL DATA.
NOT OF MY CLIENT I HAVE TO
CLIENTS THAT SELL DATA THE REST
DON'T GET THEY ALL HAVE TO PUT
PLEASE DON'T IF THEY COULD FALL
UNDER THIS THEY HAVE TO PUT
PLEASE DON'T SELL MY DATE AT THE
BOTTOM OF EVERY SCREEN.
IT REALLY DOESN'T --
DOES NOT MAKE MUCH SENSE --
SECONDLY --
WITH RESPECT TO COLLECTING
PERSONAL DATA AND DISCLOSE IT
DISCLOSING IT UNDER GPR BELIEVE
ARTICLE FOURTEEN ARTICLE
THIRTEEN IF YOU COLLECT DATA
FROM THIRD SOURCES YOU HAVE TO
DISCLOSE WHAT THE SOURCES ARE.
THIS IS A WAY TO RESOLVE THAT
SITUATION TELL THE CONSUMER
WHERE THEY CAN GO TO PULL OUT
THEIR INFORMATION AND THAT WAY
YOU CAN RESOLVE THAT.
ANOTHER WAY OF DEALING WITH THE
DEFINITION OF PERSONAL DATA THAT
WAS BROUGHT UP AND THIS IS A G.
P. R. FUNCTION WAS BROUGHT UP
EARLIER WAS DATA MINIMIZATION.
IN ORDER TO COMPLY WITH GT PR.
I DON'T HAVE --
TO I I DON'T HAVE I CAN DE
IDENTIFIED DATA I CAN SEGREGATE
IT BUT I HAVE TO SHOW THAT I AM
DOING IT.
THAT INSTEAD OF HAVING TO
PROVIDE ALL THIS INFORMATION TO
THE CONSUMER MAYBE YOU WAY IN
ORDER TO RESOLVE AND CREATE A
PAPER TRAIL TO SHOW THEIR
COMPLYING.
WITH RESPECTING PRIVACY WITHOUT
GOING THROUGH RIDICULOUS
GYRATIONS AND THE LAST POINT I
WANT TO BRING UP AND I JUST.
A TINY UP BROUGHT IT UP BROADLY
BUT I'VE ACTUALLY SEEN THIS.
THERE IS A LETTER GOING AROUND
I'LL BE GLAD TO WHICH WAS
EXAMPLE OF THE NIGHTMARE LETTER
THAT COULD BE SENT UNDER GPR.
IT WAS MEANT AS AN EXAMPLE BUT I
ACTUALLY HAD CLIENTS WHO HAVE
RECEIVED IT AS A CUT AND PASTE
THAT MODEL AND THEY HAVE
BASICALLY SAID IN THIS LETTER.
TELL ME EVERYONE OF YOUR DATA
BREACHES TELL ME HOW YOU PROTECT
MY DATA TELL ME WHAT DO YOU
COLLECT HOW SPECIFICALLY YOU
INTEND TO GET RID OF IT.
AND WHILE THAT IT BE BRIEF AND
CONCISE --
BUT IT'S AN EXAMPLE OF AN ABUSE
THAT CAN EXIST IF YOU DO NOT
HAVE SOME SORT OF LEVEL OF
AUTHENTICATION AND YOU HAVE THAT
WE APPRECIATE THAT --
BUT I DO THINK THAT WITH RESPECT
TO THIS KINDS OF ISSUES --
THERE THERE NEEDS TO BE A A
FURTHER EXPANSION RIGHT NOW
THERE ARE CERTAIN EITHER THROUGH
SAFE HARBORS A CERTIFICATIONS
LIKE -- WHAT
EXISTS WITH PRIVACY SHIELD IS
ONE WAY TO PROTECT COMPANIES TO
SHOW THAT THEY'RE TRYING TO
COMPLY?
ANOTHER WAY OF DEALING WITH IT --
THERE ARE CURRENTLY COMPANIES
OUT THERE THAT IF YOU WANT TO
LET'S SAY GET A CREDIT REPORT DO
YOU ARE REQUIRED TO SHOW CERTAIN
INFORMATION ABOUT YOURSELF THAT
THEY COLLECT.
THE COMPANY IN QUESTION DOESN'T
COLLECT IT BUT IT ICE PROVED
THAT YOU ARE WHO YOU SAY YOU ARE
THERE CERTAINLY SHOULD BE A
TECHNOLOGY SOLUTION.
THAT WILL LEAVE ENABLE --
COMPANIES TO DEAL WITH THE
EDUCATION IN THIS PARTICULAR
CASE ONE THANK YOU AGAIN FOR ALL
YOUR GREAT WORK IN SITTING
THROUGH --
THIS VERY LONG DISCUSSION FROM A
BUNCH OF US A JOKE WILL NEED A
TWELVE STEP PROGRAM TO GET
THROUGH ALL OF THIS DEALING WITH
PRIVACY BUT IT'S VERY IMPORTANT
AND THANK YOU FOR PUTTING THIS
TOGETHER TODAY AND AND THE
PANELISTS FOR DOING A FANTASTIC
JOB.
THANK YOU VERY MUCH THERE NEXT
PLEASE.
HI MY NAME IS MARK WILLIAMS AND
I'M SPEAKING TODAY ON BEHALF OF
THE ASSOCIATION OF CALIFORNIA
SCHOOL ADMINISTRATORS --
AS STATEWIDE ASSOCIATION.
THE ASSOCIATION HAS ONE CONCERN
WITH THE LEGISLATION.
AND WE HAVE A STRAIGHT.
SOLUTION TO IT --
CALIFORNIA HAS BEEN A NATIONAL
LEADER AND SO PEOPLE A LIST OF
PEOPLE IN AB FIFTEEN EIGHTY FOUR
AND HAS BENEFITTED STUDENTS IN
CALIFORNIA AND THROUGHOUT THE
COUNTRY WITH SO MANY STATES
ADOPT IN IT.
THOSE PROTECTIONS AND EXISTING
WEB OF REGULATIONS AND FEDERAL
MANDATES REGARDING OF RECORD
RETENTION FOR BOTH STUDENTS AND
EMPLOYEES HAS RESULTED AND A
VERY WELL ORGANIZED --
AND DETAILED STATUTORY STRUCTURE.
WHAT WERE WORRIED ABOUT IS THAT
CCPA HAS BLURRY BOUNDARIES
BETWEEN ITS STATUTORY MANDATES
AN EXISTING STATUTORY MANDATES
UNDER AB FIFTEEN EIGHTY FOUR AND
SO PEOPLE WE THINK THE ENTER
SACKED?
WE THINK THAT THIS WILL LEAD TO
CONFUSION AND IT MAY END UP
WATERING DOWN AB FIFTEEN EIGHTY
FOUR AND SO PEOPLE IN UNEXPECTED
WAYS.
WHICH WOULD BE IRONIC BECAUSE WE
WORLD OF STUDENT RECORDS IN MY
VIEW SUBPOENA AND AB FIFTEEN
EIGHTY FOUR HAS SUPERIOR
PROTECTIONS TO THE CCPA ON THE
SAME SUBJECTS.
WE THINK THAT THESE OVERLAPS.
AND CONCERNS CAN BE ADDRESSED
WITH SIMPLE EDITING INDICATING
THAT RECORDS WITHIN SCHOOL
DISTRICT CONTROL WILL BE
REGULATED BY FOR THE AND THE
EXISTING --
STATUTORY STRUCTURE THANK YOU
THANK YOU MUCH NEXT PLEASE.
CHRIS ROSE ON BEHALF OF THE
NONPROFIT ALLIANCE OF LAST YEAR
THE CCPA THE LEGISLATURE VERY
THOUGHTFUL.
IN EXEMPTING NON PROFITS FROM
THE LAW HOWEVER NONPROFITS IS
IMPORTANT TO REMEMBER WE DO NOT
OPERATE IN A VACUUM WE HAVE TO
USE DATA DATA IS IMPORTANT FROM.
EVERYTHING T CONNECTING WITH
POTENTIAL DONORS TO FOR FILLING
OUR PROGRAMMATIC MISSIONS.
IF DATA BECOMES TOO EXPENSIVE
TOO DIFFICULT TO OBTAIN THERE
ARE REAL AND TRUE CONSEQUENCES
AND THE NONPROFIT ALLIANCE
BELIEVES.
THAT IN FACT BECAUSE WE DO NOT
HAVE A PROFIT MARGIN WE DO NOT
HAVE A CUSHION THAT WE ARE
REALLY THE CANARIES IN THE COAL
MINE WILL BE THE FIRST ONES TO
FEEL THE IMPACT.
OF THE COST PRESSURES ASSOCIATED
WITH THE CCPA IF IT REMAINS.
NOT CLEANED UP NOT NARROWED NOT
CLARIFIED --
WE LOOK AT AREAS THAT --
PUT A LOT OF COST PRESSURES ON
THOSE WHO ARE DIRECTLY IMPACTED.
BY IMPLEMENTING THE CCPA --
THINGS FOR EXAMPLE TIONS BROAD
CATEGORIES IF WE CAN NARROW IT
AND CLARIFY IT WE'RE HOPING THAT
THAT CAN CONTRIBUTE TO
MITIGATING SOME OF THE COST
PRESSURES.
WE ARE ALSO VERY CONCERNED ABOUT
SOME OF THE IRONIC IN AN
INTENTIONAL --
ANTI PRIVACY ELEMENTS TO THE C.
CPA --
PRIVACY PROTECTION IS PARAMOUNT
CONCERNED TO CHARITIES WE ARE
VERY GOOD STEWARDS OF PERSONAL
DATA WE ASK YOU TO PLEASE LOOK
AT THE HOUSEHOLD ISSUE AND THE
ELEMENTS --
THAT CONTRIBUTES TO THE THREAT
OF OF FRAUD AS AREAS THAT WE
HOPE TO BE CLEAN AT TO BE
CLEANED UP AND WE HOPE TO WORK
WITH YOU.
TO KEEP THE MISSION AND THE
GOALS OF THE CCPA INTACT WE'RE
SUPPORTIVE OF THAT BUT WE'D LIKE
TO DO IT IN A WAY THAT.
LOOKS AT THE POTENTIAL
CONSEQUENCES SPECIFICALLY TO
NONPROFITS AS WE DO THIS WORK
THANK YOU.
THANKS MUCH AND EXPENSE.
THANK YOU MISTER CHAIR BETTER
BECOME AFTER THE NATIONAL
PAYROLL REPORTING CONSORTIUM
WHOSE MEMBERS PROVIDE PAYROLL
PROCESSING AND RELATED SERVICES
TO NEARLY TWO MILLION U. S.
EMPLOYERS.
HISTORY HAS EXPRESSED CONCERNS
ABOUT SOME OF THE BROAD
DEFINITIONS IN THE BILL
PARTICULARLY --
WITH RESPECT TO THE DEFINITION
OF CONSUMER THAT WITHOUT FURTHER
CLARIFICATION COULD BE
INTERPRETED TO APPLY THE
EMPLOYMENT.
INFORMATION THIS GOOD A
PROBLEMATIC CONSEQUENCES AND
LEAD TO INCONSISTENT APPLICATION
OF THE LAW. FOR EXAMPLE
EMPLOYERS ARE REQUIRED TO
MAINTAIN PAYROLL RECORDS AND
PERSONNEL FILES AND TO SHARE
INFORMATION FOR TAX WITHHOLDING
ANOTHER REQUIRED PURPOSES.
WITHOUT CLARIFICATION THE PEOPLE
INDUSTRY IS CONCERNED THAT LIST
COULD LEAD TO CONFUSION AND
SITUATIONS IN WHICH EMPLOYEES OR
EVEN MEMBERS OF THEIR HOUSEHOLDS
ARE REQUESTING TO DELETE
EMPLOYMENT INFORMATION INCLUDING
INVESTIGATION RECORDS.
RELATED TO SEXUAL HARASSMENT AND
OTHER CLAIMS WE ECHO THE
COMMENTS OF THE CALIFORNIA
CHAMBER OF COMMERCE AND OTHERS
ON THE SPECIFIC ISSUE.
AND SUPPORT THE NEED FOR A
LEGISLATIVE CLARIFICATION
CONSEQUENCES SHARED --
WRITTEN TESTIMONY WAS SUBMITTED
TO THE ATTORNEY GENERAL'S OFFICE
WITH YOUR COMMITTEE STAFF AND WE
LOOK FORWARD TO WORKING WITH YOU
ON THIS ISSUE THANK YOU.
THANK YOU MENTION EXPERTISE.
MISTER CHAIR MEMBERS JIM E. WORK
WITH THE CALIFORNIA NEWS
PUBLISHERS ASSOCIATION.
OF FIRST OF ALL WE WANT TO THANK
YOU FOR ADDRESSING THE CONCERN
THAT WE RAISE LAST YEAR ABOUT
THE IMPACT OF THE CCPA.
ON OUR NEWS GATHERING OPERATIONS.
WE STILL HAVE US SEVERAL
CONCERNS AND I WANT TO SHARE
WITH YOU TODAY --
AS NEWSPAPERS INCREASE THEIR
DIGITAL PRESENCE --
THE REVENUE STREAMS THAT SUPPORT
JOURNALISM --
BUT WE THINK ARE JEOPARDIZED BY
SOME OF THE DEFINITIONS IN THE
ACT -- IN
PARTICULAR THE DEFINITION OF
PERSONAL INFORMATION THE
DEFINITION OF SALE --
AND SKEWS ME IT IS.
THE REVENUE STREAMS FROM --
THE ADVERTISING OPERATIONS.
THAT HELP TO FUND THE PROGRAMS
THE JOURNALISM PROGRAMS THAT
BRING VALUABLE AND INFORMATIVE --
INFORMATION TO MEMBERS OF THE
COMMUNITY.
ARE WE DON'T BELIEVE THAT --
THE JEOPARDIZING OF THESE
REVENUE STREAM ATTENDED BY MR
MAKE TAG OR OR THE PROPONENTS OF
THE ACT --
AND WE WANT TO WORK WITH YOU AND
YOUR STAFF --
TO TRY TO RESOLVE THAT POTENTIAL
CONCERN.
BUT WE ALSO HAVE A CONCERN ABOUT
THE CURRENT DEFINITION OF OR
EXCUSE ME THE COURT APPLICATION
OF THE PROVISIONS THAT --
DISALLOW WHOSE --
INFORMATION THAT'S OBTAIN
THROUGH A PUBLIC RECORD --
AND LIMITS THAT USAGE --
WE THINK THAT IT IS --
CONSTITUTIONALLY SUSPECT IT'S
INCONSISTENT WITH CURRENT LAW IN
THE STATE OF CALIFORNIA AND WE
ALSO THINK IT'S INCONSISTENT
WITH LONG ESTABLISHED POLICY
PRINCIPLES HERE AND WE'D ALSO
LIKE TO WORK WITH YOUR STAFF --
TO FIX THAT THANK YOU THANK YOU
MUCH NEXT WITH.
GOOD MORNING EXCUSE ME JOANNE
BET IN COURT.
REPRESENTING THE SECURITIES
INDUSTRY AND FINANCIAL MARKETS
ASSOCIATION.
AS WELL AS THE INVESTMENT
COMPANY INSTITUTE.
WE'RE VERY SUPPORTIVE OF THE
CLARIFICATIONS MENTIONED BY THE
CULT CALIFORNIA CHAMBER OF
COMMERCE.
ALSO MY SPECIFICALLY --
POINT OUT THE FRAUD PRESENT
PROVISIONS THAT WERE MENTIONED.
VERY IMPORTANT TO THE SECURITY
SKERRIES INTEREST WITH ANTI
MONEY LAUNDERING AND THINGS THAT
NATURE SO WE REALLY --
HOPE THAT THAT PROVISION CAN BE
CLASSIFIED AS WELL THANK YOU.
THANK YOU MUCH NEXT PLEASE.
THANK YOU MISTER CHAIRMAN JOINT
COMMITTEE CALIFORNIA'S MANY
CHAMBERS OF COMMERCE --
WANT TO THANK YOU FOR SMALL FOR
HOLDING THESE HEARINGS --
TO LEARN MORE AND TO MAKE THE
RIGHT DECISIONS --
WE DO HAVE A FEW KEY CONCERNS --
WE DO FEEL THAT CCPA COULD JUST
PUSH THE IMPACT OF HONORABLE AND
UNDER REPRESENTED SMALL
BUSINESSES.
ALSO THAT CCPA COULD IMPOSE
HEAVY CASA BURDENS ON ON THE
SAME SMALL BUSINESSES.
WE WE MUST REMEMBER THAT SMALL
BUSINESSES OPERATED.
OPERATE UP NOW OPERATE UTILIZING
THE INTERNET TO CONNECT WITH
CUSTOMERS THE CCPA WOULD MAKE
CONNECTING MORE DIFFICULT FOR
SMALL BUSINESS THIS PEOPLE OPT
OUT.
IN BUSINESSES TAKE ON NEW
COMPLIANCE COST --
THERE IS A GROWING NUMBER OF
LATINO CONSUMERS WHO USE THE
INTERNET FOR RIGHT HERE SERVICES
ENTERTAINMENT AND PURCHASING --
WE FEEL THAT CCPA COULD IMPACT
THE ABILITY OF BUSINESSES TO
CONNECT --
WITH THIS GOING NOW NUMBERS IT
WITHIN THE LATINO POPULATION AND
FINALLY MANY LATINO BUSINESS
OWNERS USE FREE OF LOW COST
BUSINESS MANAGEMENT TOOLS SUCH
AS EMAIL SHARE DOCUMENTS AND WEB
SITES.
AND THERE WAS A KEY CONCERN ARM
THAT THESE FREE SERVICES COULD
BE ELIMINATED THANK YOU.
THANK YOU VERY MUCH A NICE PLACE.
GOOD AFTERNOON MISTER CHAIRMAN
COMMITTEE MEMBERS JOHN CAP
ATTACK ON BEHALF OF THE NATIONAL
FEDERATION OF INDEPENDENT
BUSINESS REPRESENT ABOUT TWENTY
THOUSAND SMALL INDEPENDENT
BUSINESSES IN CALIFORNIA --
FIRST OF ALL AGAIN ECHO IN
OTHERS WE DO APPRECIATE THE FACT
THAT THERE'S AN ACKNOWLEDGEMENT
THAT SOME MEASURES SHOULD BE
TAKING --
WITH REGARDS TO CONSUMER DATA
PROTECTIONS APPRECIATE THIS
DISCUSSION AND THE EFFORT HERE
HOWEVER WE DO HAVE SOME C. P. A.
IN ITS CURRENT FORM COULD HARM
THE ABILITY OF BUSINESSES.
SMALL BUSINESSES AND IS A LOT OF
BEEN A LOT OF TALK ABOUT BIG
BUSINESS BUT SMALL BUSINESSES TO
OPERATE IN CALIFORNIA --
YOU KNOW HOW THEY COMMUNICATE
AND MARKET TO THEIR CUSTOMER
BASE -- YOU
KNOW KEEP IN MIND MANY SMALL
BUSINESSES SPEND A VERY SMALL
AMOUNT OF MONEY ON FOR INTERNET
ADVERTISING BECAUSE HE SIMPLY
UNLIKE A LARGER BUSINESS CAN
AFFORD TV OR NEWSPAPER
ADVERTISING.
OTHER CONCERNS ARE HOW CONSUMERS
HOW CONSUMERS CAN FIND AND WE
RECEIVE INFORMATION FROM THE
BUSINESS IS THAT THEY WANT TO
COMMUNICATE WITH THAT WE'RE NOT
CREATING UNDUE BURDENS FOR
CONSUMERS AND COST AS WELL.
AND THEN HOW MUCH FINALLY HOW
MUCH TIME AND RESOURCES SMALL
BUSINESSES WILL SPEND ON
REPORTING PEOPLE ARE KIND OF
MANY OF YOU HERE IN YOUR
DISTRICTS ABOUT THE PAPERWORK
REQUIREMENTS SMALL IS THAT.
HOW MUCH MORE SMALL BUSINESS IS
GOING TO BE BURDENED WITH THAT
AND TO THAT OF TO THAT END HOW
MANY SMALL AND MEDIUM BUSINESSES
THAT ARE NOT WITHIN CALIFORNIA
MIGHT GIVE A SECOND THOUGHT TO
EXPANDING OR RELOCATING WITHIN
CALIFORNIA DUE?
TO THE COULDN'T POTENTIAL
CONCERNS OF COSTS FINES AND EVEN
LAWSUIT SO --
WE BELIEVE THE C. C. P. A. AS A
STARTING POINT FOR DISCUSSION
BUT FRANKLY IT HAS TO WORK FOR
SMALL BUSINESS WELL TO MAKE SURE
THAT OUR JOB CREATORS ARE NUMBER
ONE JOB CREATORS.
ARE NOT ADVERSELY IMPACTED BY
THIS BY THIS LINE THAT IT'S DONE
RIGHT THINK.
THINGS MERCHANDISE PLEASE.
MISTER CHAIR MEMBERS OF THE
COMMITTEE THANKS SO MUCH FOR THE
OPPORTUNITY TO SPEAK TODAY.
MY NAME'S MAUREEN MAHONEY AND I
REPRESENT CONSUMER REPORTS AND
WE COMMEND CALIFORNIA LAWMAKERS
FOR PASSING THE CALIFORNIA
CONSUMER PRIVACY ACT LAST YEAR.
DEFENDING AND EXPANDING THE
PROTECTIONS UNDER THE LAW IS ONE
OF OUR TOP PRIORITIES WE WERE AN
EARLY SUPPORTER OF THE BALLOT
INITIATIVE AND WE'RE PLEASED TO
MANY OF THE INITIATIVES
PROVISIONS.
WERE SIGNED INTO LAW.
IS BECAUSE CONSUMERS HAVE
REPEATEDLY MADE IT CLEAR THEY
WANT MORE NOT PURE PRODUCTIONS --
AND CERTAINLY THIS LEGISLATION
IS A STEP.
STRONG ENFORCEABLE PRIVACY
PROTECTIONS ARE NEEDED NOW MORE
THAN EVER AND DUE TO THE
WIDESPREAD AND LARGELY
UNREGULATED SALE OF CONSUMER
DATA ON THE OPEN MARKET.
CONSUMERS DESERVE DATA
MINIMIZATION STRONG CONTROLS
OVER THE SHARING OF THEIR
PERSONAL INFORMATION.
AN ADEQUATE ENFORCEMENT
MECHANISMS TO HOLD COMPANIES
ACCOUNTABLE. TO THAT END THERE
ARE WAYS THAT THE LAW COULD BE
IMPROVED TO BE MORE PROTECTIVE
OF CONSUMERS.
PRIVACY LEGISLATION SHOULD
INCLUDE DATA MINIMIZATION MOTHER
IS LIMITING THE INFORMATION THAT
COMPANIES COLLECTS TO THAT WHICH
IS REASONABLY NECESSARY TO
OPERATE THE SERVICE.
IN ADDITION STRONG ENFORCEMENT
IS ESSENTIAL WERE PARTICULARLY
TROUBLED BY THE LAWS RIGHT TO
CARE PROVISION WHICH WOULD ALLOW
A BUSINESS TO AVOID
RESPONSIBILITY FOR BREAKING THE
LAW.
SONGS IT STOPS WITHIN THIRTY
DAYS OF BEING CAUGHT.
THE BILLS WE CAN FOR SPENT
MECHANISMS NEED TO BE IMPROVED
BEFORE IT GOES INTO EFFECT IN.
TWENTY TWENTY FOR THE MORAL
LAWMAKERS SHOULD RESIST EFFORTS
TO WATER DOWN OR WE CAN ALONG.
FOR EXAMPLE WE STRONGLY OPPOSE
EFFORTS TO EXCLUDE DEVICE DATA
EXAM TARGETED ADVERTISING WE CAN
THE RIGHT TO ACCESS AND
PORTABILITY PROVISIONS AND
ELIMINATE IMPORTANT.
PROTECTIONS FOR CONSUMERS
PARTICIPATING IN LOYALTY
PROGRAMS.
THIS IS SENSIBLE LEGISLATION
THAT WILL GIVE CONSUMERS NEED A
PROTECTIONS IT WILL NOT AFFECT
EXISTING PROFIT MODEL FOR ONLINE
BUSINESSES.
WE LOOK FORWARD TO WORKING WITH
ALLIED GROUPS AND STATE
LAWMAKERS TO ENACT MORE
SUBSTANTIAL AND COMPREHENSIVE
REFORMS TO CALIFORNIA'S PRIVACY
AND SECURITY FRAMEWORK THANKS SO
MUCH.
THANK YOU MATCHA NEXT PLACE.
MISTER CHAIR CORPS IN JENSEN
WITH TECH MAN THANK YOU FOR
HOLDING THIS INFORMATIONAL
HEARING TODAY GIVEN THE QUICK
PROCESS LAST YEAR WE BELIEVE IT
IS IMPORTANT TO DISCUSS THE
POTENTIAL ON AND CON UNINTENDED
CONSEQUENCES OF THIS LAW ON THE
CALIFORNIA ECONOMY.
AND COMPANIES WE REPRESENT
ESPECIALLY FOR INNOVATIVE START
UPS THAT ARE GROWING THEIR
BUSINESSES AND CREATING JOBS IN
CALIFORNIA I'D LIKE TO ASSOCIATE
MY COMMENTS WAS THOSE OF THE CAL
CHAMBER AND THE OTHER INDUSTRY
REPRESENTATIVES THAT SPOKE TODAY.
WE LOOK FORWARD TO CONTINUING TO
WORK WITH YOU AND YOUR STAFF ON
THIS BILL THANK YOU.
THANK YOU NICE PLACE.
CHAIRMAN CHAU PAUL THAT FILTER
REPRESENTING THE CONSUMER DATA
INDUSTRY ASSOCIATION AND ALSO --
EXPERIENCE WHICH IS A MEMBER OF
THAT ORGANIZATION FIRST AND
FOREMOST I WANT TO SAY THAT.
OUR GOAL THIS YEAR IS TO
IMPLEMENT THE LAW BUT TO ENSURE
THAT -- THE
INTENT TO NOT COMPROMISE LE
LEGITIMATE BUSINESS PURPOSES AS
BEEN SHOWN TODAY WITH THE BY A
PREVIOUS WITNESSES WE ALSO
SUPPORT THE COMMENTS BY THE
CALIFORNIA CHAMBER OF COMMERCE.
AND SOME OF THOSE ISSUES --
THAT NEED TO BE ADDRESSED --
AND THE AREA SPECIFICALLY THAT'S
OF IMPORTANCE TO THE CONSUMER
DATA INDUSTRY ASSOCIATION AS A
FAIR CREDIT REPORTING ACT
SHORING UP FRAUD TOOLS ARE NOT
COMPROMISE.
AND THAT COMMERCIAL CREDIT
REPORTS ARE TREATED APPROPRIATE
APPROPRIATELY VERY MUCH
APPRECIATE THE FACT --
THAT WE HAVE WORKED WITH YOU AND
YOUR STAFF ON THIS ISSUE.
CONTINUE --
TO DO SO AND THANK YOU FOR YOUR
INTEREST IN THIS HEARING.
TAKE YOUR IMAGINEXT PLEASE.
MISTER CHAIR MEMBERS STEVE
CARLSON FOR CTI A WE ARE THE
TRADE ASSOCIATION MEMBERS
INCLUDE.
A WIRELESS CARRIERS DEVICE
MANUFACTURERS SUPPLIERS AS WELL
AS APPS AND CONTENT COMPANIES --
ONE IT SURE APPRECIATION TO THE
CHAIR AND IN PARTICULAR STAFF
FOR ALL THE WORK THAT THEY'VE
DONE PUT THIS TOGETHER.
I PARTICIPATED IN A COUPLE OF
THE AG PUBLIC FORUMS --
AND THEN TODAY --
AND THERE'S A CONTINUING THREAD
I THINK WE PROVIDING COMMENTS ON
SOME OF THE TO THE AG ON SOME OF
THESE ISSUES BUT TO THE EXTENT
THERE MAY BE SOME STATUTORY
CHANGES.
THAT HAVE TO HAPPEN IN ORDER
EFFECTUATE THESE THINGS THAT I
THINK THIS IS AN BEEN IMPORTANT
AT A ROBUST DEBATE --
THE ISSUES THAT YOU KEEP HEARING
OUR DEFINITION CONSUMERS STEPHAN
DEFINITION PERSONAL INFORMATION
THE HOUSEHOLD DEVICES SHE WAS
PARTICULARLY --
AN ISSUE FOR WIRELESS INDUSTRY
AND THE FACT THAT WE HAVE FAMILY
PLANS OTHER COULD BE COMPROMISED --
BECAUSE OF THIS LACK.
LEGAL INFORMATION SPECIFIC
PIECES OF INFORMATION ONLINE ADS
LOYALTY PROGRAMS THESE ARE ALL
IMPORTANT PARTS OF OUR ECOSYSTEM
IN CALIFORNIA.
AND WE NEED TO GET IT RIGHT AND
AGAIN THANK YOU VERY MUCH FOR
HOLDING THE HEARING AND WE LOOK
FORWARD TO WORKING WITH YOU.
THANK YOU MY CHEN NEXT PLACE.
MISTER CHAIR MIKE BELOW.
TODAY ON BEHALF THE CALIFORNIA
EMPLOYMENT LAW COUNSEL I KNOW
YOU'VE ALREADY HEARD FROM MR AT
BANK I THINK HE EFFECTIVELY
TALKED ABOUT.
THE EMPLOYMENT QUESTION A
DEFINITION OF CONSUMER I JUST
THINK OUR MEMBERS LARGE
COMPANIES WHO WILL BE COMPLYING
WITH -- CCPA
AT OUR BUILDING PORTALS NOW ON
GDP ARE AND THE INVESTING LOTS
OF RESOURCES THEY'VE ASKED US TO
JUST PLAINTIVELY SAY --
EIGHT EMPLOYEE AS AN EMPLOYEE IS
NOT A CONSUMER FOR PURPOSES OF
CCPOA WE'VE TALKED TO YOUR STAFF
ABOUT IT WOULD LIKE TO CONTINUE
THOSE DIALOGUES.
AS YOU LOOK FOR AREAS OF COMMON
GROUND IN TO IT OPT IN OPT OUT
MORE P. R. A. LESS P. ARE A THE
ISSUE OF EMPLOYMENT APPLICATION
I THINK IT'S SOMETHING THAT
PEOPLE MIGHT BE ABLE TO AGREE ON
AND IS A REAL IMPORTANT ONE TO
CALIFORNIAN PLAYERS.
THANK YOU THANK YOU VERY MUCH.
SEEING NO OTHER COMMENTS FROM
THE PUBLIC I WANNA TAKE THIS
OPPORTUNITY TO THANK ALL OF YOU.
FOR BEING HERE FOR THE FALL AND
THANK YOU FOR YOUR INPUT AND IF
YOU HAVEN'T DONE SO FEEL FREE TO
SUBMIT YOUR COMMENTS IN WRITING
TO US.
AND EXPLAIN OR ELABORATE ON THE
COMMENTS AND SUGGESTIONS YOU
HAVE MADE TODAY.
AND ALSO MAYBE SEE SEE YOUR COPY
TO THE ATTORNEY GENERAL'S OFFICE --
IF APPROPRIATE.
AND I WANT TO THANK ALL OF YOU
AGAIN FOR YOUR PARTICIPATION IN --
LOOK FOR TO WORKING WITH YOU AND
LOOKS LIKE IT'S GOING TO BE A
BUSY YEAR AYE THIS WHAT I CALL
SO WELL THANK YOU VERY MUCH FOR
BEING HERE.
MEETING IS ADJOURNED