CCPA Amendment Blocked by California Senate

In February, Senator Hannah-Beth Jackson introduced Senate Bill 561, with the endorsement of the California Attorney General. The bill was intended to make the CCPA more consumer-friendly by:

1. Expanding the private right of action to any violation of the CCPA
2. Eliminating the right to cure an alleged violation of the CCPA within 30 days of noncompliance
3. Absolving the California Attorney General from his responsibility to issue guidance in response to requests for clarification of the CCPA 

Had Senate Bill 561 passed, rights under the CCPA would have become significantly broader than the original draft.

In striking down the proposed amendment, the rights currently offered are likely to remain the same. Namely, the current version of the CCPA only permits a private right of action in the event that a consumer’s non-encrypted or non-redacted personal information is subject to breach due to a business’s failure to implement reasonable security safeguards, businesses are given 30 days to cure any alleged violation after being notified of the alleged noncompliance, and businesses may seek the advice of the Attorney General on how to comply with the CCPA.

Following the bill’s rejection, Senator Jackson commented that “Californians overwhelmingly support stronger consumer privacy protections” and “I’m disappointed, but the fight for our fundamental right to privacy in this digital age is too important for any of us to give up on now.” The only other bill to contain an expansion of the private right of action, Assembly Bill 1760, failed in the Assembly Privacy Committee in April. With the California Senate’s rejection of Senate Bill 561, this means the private right of action will remain limited to data breaches.

Unlike Senator Jackson, businesses in California likely welcome the rejection of the recent bill.  As businesses are bracing for a flood of class action complaints under CCPA, the deluge may have become overwhelming had Senate Bill 561 passed. Still, all businesses impacted by CCPA should ensure that they are taking appropriate measures to prepare themselves for the new law.