Changes to CCPA (California Consumer Protection Act) point to the question “how should our society approach the collection versus protection of personal information?” 

In her book, The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power, Shoshana Zuboff describes “surveillance capitalism” as “unilaterally claiming human experience as free raw material for translation into behavioral data.” In our current era of pervasive digital technology, citizens across society are separated into two groups: the watchers and the watched.  

California Consumer Protection Act (CCPA) is this nation’s first consumer privacy law. Spurred into being with a 2017 ballot introduction by California real estate developer and activist Alastair Mactaggart, the CCPA continues to evolve. This past fall, Mactaggart introduced a new ballot initiative modifying the original privacy law to address insufficiencies in the first round. The new initiative – California Privacy Rights Act (CPRA) – strengthens individual’s rights for privacy of personal information by more strictly controlling how big businesses and tech giants use and collect data.  

With close to one million signatures, the CPRA is slated for inclusion on the November 2020 ballot. As explained by the National Law Review, the CPRA ballot proposes to expand CCPA by:  

1. Establishing California Privacy Protection Agency – agency for enforcing privacy laws and imposing fines 
2. Requiring businesses to disclose automated decision-making – around performance at work, economic situation, health and personal preferences, as well as allowing opt-out rights in regard to automated decision-making process
3. Establishing new category of information called Sensitive Personal Information – including information such as sexual orientation, private communications, health status, geolocation, religion, race, finances and biometrics
4. Adding more protections for children’s personal information
5. Reinforcing that businesses must follow their own disclosures – businesses have to disclose reasons for types and amount of personal information collected, along with duration of information retention 

The CPRA campaign introduced by Mactaggart and his organization, Californians for Consumer Privacy, speaks to the continuing clash between consumers and corporations. GDPR, CCPA, and now, likely the CPRA, establish legal precedent around managing personal information in the private and public sectors. The legal approach to regulation of data collection is certainly evolving in California and as evidenced by the 2019 log on privacy legislation, will continue to expand in every state.  

These blogposts have a bit more background on privacy legislation.