California’s lawmakers took a much-needed step last year by passing the California Consumer Privacy Act as a foundation for consumer privacy rights. Now they need to step up to make sure it can work as intended. One of the major issues identified by the California Attorney General (AG) Xavier Becerra is that the limited resources the legislature has provided the AG to protect consumer privacy means the CCPA’s goals — and the privacy rights Californians want and deserve — will be undercut before the law goes into effect next year.

In response, California’s Senate Judiciary Committee this week passed Sen. Hannah-Beth Jackson’s bill, S.B. 561, which would give the AG’s office much-needed support to enforce the law, including by allowing every Californian to act as their own privacy enforcer with the right to challenge companies that violate their privacy in court. 94 percent of Californians want the right to take a company to court if they violate their privacy rights, according to polling from the American Civil Liberties Union. S.B. 561 also eliminates the 30-day “right to cure” in the CCPA that gives companies that have already violated people’s privacy rights a grace period to clean up their act after the fact. It also eliminates any taxpayer subsidies for compliance with the law as originally written into the bill as a favor to industry.

Attorney General Becerra has been crystal clear that the CCPA does not provide the tools his office needs to protect our privacy. Immediately after the law passed, Becerra sent a letter to the legislature, outlining several concerns about the law and how much strain it could place on his office, because it centralized enforcement power within the Attorney General's office (AGO).

Crucially, he pointed out that the CCPA has only a limited right for people to sue companies that violate their privacy rights; the current law only allows a lawsuit for data breaches. He asked for consumers to have the right to sue for any violation of the law.

“The lack of a private right of action, which would provide a critical adjunct to governmental enforcement, will substantially increase the AGO’s need for new enforcement resources,” Becerra wrote in August. “I urge you to provide consumers with a private right of action under the CCPA.”

Holding Companies Accountable

Sen. Jackson heard Becerra’s call and crafted a bill that includes a private right of action for any CCPA violation. Augmenting the basic enforcement measures in the CCPA assures that Californians can enjoy the rights the law promises.

Without such measures, it's basically “having a right without a remedy," as Chair Jackson put it herself to her Judiciary Committee colleagues.

Lawmakers say they want to hold companies accountable for the ways these firms use and abuse our personal information. Yet the current law leaves people with no way to fight back against even clear-cut, egregious privacy violations. For example, the CCPA currently gives people the right to ask companies not to sell their data, but only the AG can bring a lawsuit to enforce that right. Thus, if a provider sold people's geo-location information to bounty hunters — something AT&T, T-Mobile, and Sprint actually did until federal lawmakers learned about it from a Motherboard investigation and called on the FCC to stop them — the victims could not themselves sue.

Companies can and must be held accountable for their harmful actions. Becerra and his office have made clear the path they see to doing so is by making sure more people can enforce the law—adding a force of millions of Californians to act as their own advocates. 

Sticking to “The Deal” that Passed CCPA? What About Your Duties to Your Constituents?

Some senators on the committee said that strengthening the CCPA—and giving the AG the tools he himself believes necessary to protect the privacy of Californians — breaks a “deal” lawmakers struck with the tech industry to pass the CCPA in the first place.

What lawmakers should remember is that their most important deal is with their constituents. 96 percent of Californians, across every demographic, support stronger privacy laws according to ACLU polling. In fact, we have consistently seen polls show a super majority of Americans believe they should be able to say no to companies that monetize their personal information without their permission. Meanwhile, companies are already working to erode the law by sponsoring bills to weaken the CCPA and add carveouts for their own benefit.

These polling numbers should tell lawmakers all they need to know. But if they need further convincing, they should listen to the person most familiar with the capabilities and limits of the Attorney General’s Office — literally, the Attorney General — who is asking the legislature for help. 

Californians deserve the privacy that the California Constitution and the legislature have already affirmed is their right. Now, they need a law that they can enforce.