PD Editorial: Too soon to make changes in online privacy law

The California Consumer Privacy Act, a state law giving people new tools to protect their data online, made headlines when it took effect on Jan 1.

NPR called it “the toughest data privacy law in the U.S.

NBC News said “California is bringing law and order to big data.”

The Guardian said Californians gained “unprecedented rights to control what information companies collect on them and how it is used.”

Less than a year later, California voters are asked to sort out Proposition 24, a substantial revision of the new law.

If you’re like us, you’re still trying to figure out the scope of this new law and how best to exercise your new online privacy rights. That’s true for many companies, too, especially small businesses that don’t employ in-house legal teams or internet experts.

Our conclusion: It’s too soon to put this complicated issue on the ballot.

That’s based in part on a lack of experience with which to assess the new law. Not only is it less than a year old, the implementing regulations weren’t released until mid-August.

Moreover, leading advocates of consumer privacy are sharply divided on whether Proposition 24 would make California’s law stronger or weaker.

Supporters include Andrew Yang, the former tech executive who ran for president this year. The ACLU and the Consumer Federation of California are opposed. The Electronic Frontier Foundation, one of the most aggressive defenders of online privacy, is staying neutral, calling Proposition 24 “a mixed bag of partial steps backwards and forwards.”

The conflicting assessments reflect Proposition 24’s unusual route to the ballot.

Alistair Mactaggart, a San Francisco real estate developer, decided to pursue an online privacy initiative in 2015 and gathered enough signatures to place it on the 2018 ballot. He then agreed to withdraw the initiative and work with state Sen. Bob Hertzberg, D-Los Angeles, to pass an online privacy statute through the Legislature. The result was the California Consumer Privacy Act.

The law requires companies to provide, on request, a copy of all personal information they have collected about an individual and to disclose some details about how it was gathered and sold. The law also allows individuals to ask companies to delete personal information that has been collected and to opt out of having information collected in the first place.

Mactaggart and Hertzberg say there are loopholes in the law. Proposition 24would tighten the rules for sharing data, allow people to opt out of tracking methods used by Google and some ad networks and create a new state agency to enforce the law, which currently is the responsibility of the attorney general. It also would take away the opportunity for businesses to voluntarily rectify violations to avoid fines.

Their goal is laudable, and they may be proven correct about the law. But at 52 pages and 27,106 words of legalese, their proposal is a lot to assess. And with enforcement of the existing law barely underway, it’s too soon to determine whether they identified all of the shortcomings of their statute, or even the most pressing problems.

Online privacy is a new frontier for individuals and businesses alike. We think Mactaggart was wise to pursue protections through the legislative process, which has opportunities for all interested parties to give input. If the law proves inadequate, it makes sense to return to the Legislature to seek changes before asking voters to sort out something so arcane that it even divides the experts.

The Press Democrat recommends a no vote on Proposition 24.

You can send letters to the editor to letters@pressdemocrat.com.