More major privacy and data protection developments are in the works in California, following three significant new laws reported here. On September 25, 2013, the California Secretary of State approved steps required to bring before state residents a ballot initiative entitled the Personal Privacy Protection Act (the “Act”).
The Act, proposed by former CA State Senator Steve Peace and attorney Michael Thorsnes, would amend the California Constitution by adding a new Article establishing “the fundamental right of every person to pursue and obtain privacy,” and finding that “a natural person’s right to control and protect his or her personally identifying information and to be able to enforce that right when harmed is fundamental to his or her ability to pursue and obtain privacy.”
Specifically, the Act would: (a) create a presumption of harm where an individual’s confidential personally identifying information (defined broadly) (“PII”) has been disclosed without his or her authorization; (b) create a presumption that California residents’ PII is confidential; and (c) prohibit companies from sharing California residents’ PII without authorization, unless there are countervailing compelling interests (such as public safety) and no reasonable alternative for accomplishing such compelling interest.
Signatures of 807,615 California voters are required by February 24, 2014 in order for the Act to be put to a ballot vote in November 2014. Should the Act be approved by a majority vote in November 2014, it would take effect January 1, 2016.
If passed, the Act’s presumption of harm could significantly impact data breach class action litigation which, to date, has largely been dismissed on standing grounds for inability to prove injury-in-fact where class members have not suffered actual identity theft. The Act’s opt-in data sharing scheme would also likely prompt a significant increase in companies’ use of broad and general consent requirements. Impact of the Act, if passed, would likely be widespread, as many companies, especially online, collect information from California residents.
To view the Personal Privacy Protection Act, click here.
Acknowledgement also to David Anderson for his contribution