A California lawmaker introduced a privacy bill in the state legislature that would require Internet companies to notify state residents about their data collection practices and to provide an opt out option. Companies would be prohibited from collecting or using covered information if a consumer exercises his right to opt out.
State Senator Alan Lowenthal (D – Long Beach) introduced SB 761, that would require the California Office of Privacy Protection and the attorney general to adopt regulations to establish a means under which consumers can opt out of online collection. The bill’s definition of personal information includes an individual’s online activity as well as his/her name, address, telephone number, e-mail address, and IP address.
“We think this is a reasonable and thoughtful way to provide consumers greater control over their own data,” Lowenthal said at a press conference to announce his legislation. SB 761 applies to all “connected devices,” including personal computers, tablets, smartphones, and Internet TVs, and would require covered entities to disclose to consumers their practices on collecting, using, and storing information.
Federal, state, and local governments are exempt under the bill, as are entities that can demonstrate they store covered information from fewer than 15,000 individuals or collect information from fewer than 10,000 individuals during a 12-month period.
The law includes a private right of action, specifies damages of up to $1,000 per violation, and permits the possibility of punitive damages.
To read SB 761, click here.
Why it matters: While Congress considers two proposed pieces of privacy legislation, could California pass its own law? The state has led the legislative way in the past and was the first state to adopt a data breach notification law and a do-not-call list. Several consumer groups have indicated support for the bill, including Consumer Watchdog, Privacy Rights Clearing House, Common Sense Media, and the California Consumer Federation. But a state-specific privacy law could wreak havoc on companies with an Internet presence, noted Mike Zaneis, the general counsel of the Interactive Advertising Bureau. “Any company doing business with a California resident would have the burden of both identifying them to be a computer user based in California, and then complying with any requirement of quote-unquote ‘collecting information,’” he told MediaPost. Zaneis also told the San Francisco Chronicle that the bill was “inherently unconstitutional,” as the Constitution gives Congress the power to regulate interstate commerce, not states, and that the Internet, by its very definition, is interstate.