The CPRA The California Privacy Rights Act of 2020 Proposition 24 in the November 2020 General Election SECTION 1. Title. This measure shall be known and may be cited as “The California Privacy Rights Act of 2020.” SEC. 2. Findings and Declarations. The People of the State of California hereby find and declare all of the following: (A) In 1972, California voters amended the California Constitution to include the right of privacy among the “inalienable” rights of all people. Voters acted in response to the accelerating encroachment on personal freedom and security caused by increased data collection and usage in contemporary society. The amendment established a legal and enforceable constitutional right of privacy for every Californian. Fundamental to this right of privacy is the ability of individuals to control the use, including the sale, of their personal information. (B) Since California voters approved the constitutional right of privacy, the California Legislature has adopted specific mechanisms to safeguard Californians’ privacy, including the Online Privacy Protection Act, the Privacy Rights for California Minors in the Digital World Act, and Shine the Light, but consumers had no right to learn what personal information a business had collected about them and how they used it or to direct businesses not to sell the consumer’s personal information. (C) That changed in 2018, when more than 629,000 California voters signed petitions to qualify the California Consumer Privacy Act of 2018 for the ballot. In response to the measure’s qualification, the Legislature enacted the California Consumer Privacy Act of 2018 (CCPA) into law. The CCPA gives California consumers the right to learn what information a business has collected about them, to delete their personal information, to stop businesses from selling their personal information, including using it to target them with ads that follow them as they browse the internet from one website to another, and to hold businesses accountable if they do not take reasonable steps to safeguard their personal information. (D) Even before the CCPA had gone into effect, the Legislature considered many bills in 2019 to amend the law, some of which would have significantly weakened it. Unless California voters take action, the hard‐fought rights consumers have won could be undermined by future legislation. (E) Rather than diluting privacy rights, California should strengthen them over time. Many businesses collect and use consumers’ personal information, sometimes without consumers’ knowledge regarding the business’s use and retention of their personal information. In practice, consumers are often entering into a form of contractual arrangement in which while they do not pay money for a good or service, they exchange access to that good or service in return for access to their attention, or access to their personal information. Because the value of the personal information they are exchanging for the good or service is often opaque, depending on the practices of the business, consumers often have no good way to value the transaction. In addition, the terms of agreement or policies in which the arrangements are spelled out, are often complex, unclear, and as a result most consumers never have the time to read or understand them. (F) This asymmetry of information makes it difficult for consumers to understand what they are exchanging and therefore to negotiate effectively with businesses. Unlike in other areas of the economy where consumers can comparison shop, or can understand at a glance if a good or service is expensive or affordable, it is hard for the consumer to know how much his or her information is worth to any given business, when data use practices vary so widely between businesses. (G) The State therefore has an interest in mandating laws that will allow consumers to understand more fully how their information is being used, and for what purposes. In the same way that ingredient labels on foods help consumers shop more effectively, disclosure around data management practices will help consumers become more informed counterparties in the data economy, and promote competition. Additionally, if a consumer can tell a business not to sell his or her data, then that consumer will not have to scour a privacy policy to see whether the business is, in fact, selling that data, and the resulting savings in time is worth, in the aggregate, a tremendous amount of money. (H) Consumers need stronger laws to place them on a more equal footing when negotiating with businesses in order to protect their rights. Consumers should be entitled to a clear explanation of the uses of their personal information, including how it is used for advertising, and to control, correct, or delete it, including by allowing consumers to limit businesses’ use of their sensitive personal information to help guard against identity theft, to opt‐out of the sale and sharing of their personal information, and to request that businesses correct inaccurate information about them. (I) California is the world leader in many new technologies that have reshaped our society. The world today is unimaginable without the internet, one of the most momentous inventions in human history, and the new services and businesses that arose on top of it ‐‐ many of which were invented here in California. One of the most successful business models for the internet has been services that rely on advertising to make money as opposed to charging consumers a fee. Advertising‐supported services have existed for generations, and can be a great model for consumers and businesses alike. However, some advertising businesses today use technologies and tools that are opaque to consumers to collect and trade vast amounts of personal information, to track them across the internet, and to create detailed profiles of their individual interests. Some companies that do not charge consumers a fee, subsidize these services by monetizing consumers’ personal information. Consumers should have the information and tools necessary to limit the use of their information to non‐invasive, pro‐privacy advertising, where their personal information is not sold to or shared with hundreds of businesses they’ve never heard of, if they choose to do so. Absent these tools, it will be virtually impossible for consumers to fully understand these contracts they are essentially entering into when they interact with various businesses. (J) Children are particularly vulnerable from a negotiating perspective with respect to their privacy rights. Parents should be able to control what information is collected and sold or shared about their young children and should be given the right to demand that companies erase information collected about their children. (K) Business should also be held directly accountable to consumers for data security breaches and notify consumers when their most sensitive information has been compromised. (L) An independent watchdog whose mission is to protect consumer privacy should ensure that businesses and consumers are well‐informed about their rights and obligations and should vigorously enforce the law against businesses that violate consumers’ privacy rights. SEC. 3. Purpose and Intent. In enacting this Act, it is the purpose and intent of the people of the State of California to further protect consumers’ rights, including the constitutional right of privacy. The implementation of this Act shall be guided by the following principles: (A) Consumer Rights (1) Consumers should know who is collecting their personal information and that of their children, how it is being used, and to whom it is disclosed, so that they have the information necessary to exercise meaningful control over businesses’ use of their personal information and that of their children. (2) Consumers should be able to control the use of their personal information, including limiting the use of their sensitive personal information, the unauthorized use or disclosure of which creates a heightened risk of harm to the consumer, and they should have meaningful options over how it is collected, used, and disclosed. (3) Consumers should have access to their personal information and should be able to correct it, delete it, and take it with them from one business to another. (4) Consumers or their authorized agents should be able to exercise these options through easily accessible self‐serve tools. (5) Consumers should be able to exercise these rights without being penalized for doing so. (6) Consumers should be able to hold businesses accountable for failing to take reasonable precautions to protect their most sensitive personal information from hackers and security breaches. (7) Consumers should benefit from businesses’ use of their personal information. (8) The privacy interests of employees and independent contractors should also be protected, taking into account the differences in the relationship between employees or independent contractors and businesses, as compared to the relationship between consumers and businesses. In addition, this law is not intended to interfere with the right to organize and collective bargaining under the National Labor Relations Act. It is the purpose and intent of the Act to extend the exemptions in this title for employee and business to business communications until January 1, 2023. (B) The Responsibilities of Businesses (1) Businesses should specifically and clearly inform consumers about how they collect and use personal information and how they can exercise their rights and choice. (2) Businesses should only collect consumers’ personal information for specific, explicit, and legitimate disclosed purposes, and should not further collect, use, or disclose consumers’ personal information for reasons incompatible with those purposes. (3) Businesses should collect consumers’ personal information only to the extent that it is relevant and limited to what is necessary in relation to the purposes for which it is being collected, used, and shared. (4) Businesses should provide consumers or their authorized agents with easily accessible means to allow consumers and their children to obtain their personal information, to delete it, or correct it, and to opt‐out of its sale and the sharing across business platforms, services, businesses and devices, and to limit the use of their sensitive personal information. (5) Businesses should not penalize consumers for exercising these rights. (6) Businesses should take reasonable precautions to protect consumers’ personal information from a security breach. (7) Businesses should be held accountable when they violate consumers’ privacy rights, and the penalties should be higher when the violation affects children. (C) Implementation of the Law (1) The rights of consumers and the responsibilities of businesses should be implemented with the goal of strengthening consumer privacy, while giving attention to the impact on business and innovation. Consumer privacy and the development of beneficial new products and services are not necessarily incompatible goals. Strong consumer privacy rights create incentives to innovate and develop new products that are privacy protective. (2) Businesses and consumers should be provided with clear guidance about their responsibilities and rights. (3) The law should place the consumer in a position to knowingly and freely negotiate with a business over the business’ use of the consumer’s personal information. (4) The law should adjust to technological changes, help consumers exercise their rights, and assist businesses with compliance, with the continuing goal of strengthening consumer privacy. (5) The law should enable pro‐consumer new products and services and promote efficiency of implementation for business, provided that the amendments do not compromise or weaken consumer…