Washington Lawyer - October 2019 - 21

behind closed doors, we are not seeing how far these folks are along the road,"
says Michelle Richardson, director of the Privacy and Data Project at the Center
for Democracy & Technology (CDT), a nonprofit advocacy group. "Once major
proposals from the House and Senate leadership are out, I expect them to
move much more quickly."

THE 'GOLDEN' RULES
In the absence of a new federal law, and to the chagrin of tech lobbyists
in Washington, Sacramento has filled the void. The California Consumer
Privacy Act (CCPA) was passed quickly by the state legislature and signed
into law in June 2018 by Gov. Jerry Brown. The law takes effect January 1,
2020, but there will be approximately a half-year phase-in period as the
California attorney general sets the rules for its enforcement.
The law grants consumers a right to request that businesses disclose the
personal information they collect and how they use it. Consumers also
can request deletion of personal information and disclosure of the third
parties to which the information is sold or shared. Consumers can opt out
of the sale of their personal information, although businesses can offer
financial incentives to consumers to allow them to collect data.

"

The California law defines what is "personal information" broadly,
including a list of personal characteristics and behaviors, as well as
inferences that can be drawn from this information.
"What it generally does is it empowers consumers to have control over
how companies operating in California, which are businesses subject to
the law, collect, use, and share their personal data. It requires a lot more
transparency on the part of businesses, and it affords consumers a lot
more rights over what these businesses do with their data, to have data
deleted or corrected, or to say it cannot be sold," says Jeff Poston, cochair
of the privacy and cybersecurity group at Crowell & Moring LLP.
"If you are a company of sufficient size and reach and are subject to the law, it
will become your de facto privacy standard in the United States," Poston says.
"The CCPA is the privacy equivalent of the hula hoop. You can expect laws
to move east with the trend. You are going to see more states adopt
privacy laws."
Nevada and Maine have adopted data privacy laws that include features
like California's, although both are narrower in scope. For example, Maine's
act applies only to broadband internet access service providers. Other
states that are considering data privacy legislation include Hawaii, Illinois,
Louisiana, Maryland, Massachusetts, Minnesota, New Jersey, New York,
Rhode Island, Pennsylvania, Texas, and Washington, according to the
International Association of Privacy Professionals.
What has tech and other companies more worried is that the CCPA
provides for a private right of action by consumers against companies
that have been subjected to data breaches. That means there will be
class-action lawsuits, and no one knows yet how they will play out until
California courts have a chance to decide actual cases.
"It's basically a negligence standard," says Reed Freeman, cochair of the
cybersecurity and privacy practice at Wilmer Cutler Pickering Hale and
Dorr LLP.
"Beginning in July 2020 when enforcement takes effect, I would expect
that the breaches that are announced will be followed very quickly by
class-action lawyers trying to get to the courthouse first and asking questions later because there are statutory damages, and that is a powerful
motivator for class-action lawyers," Freeman says.

Beginning in July 2020 when enforcement takes
effect, I would expect that the breaches that
are announced will be followed very quickly by
class-action lawyers trying to get to the courthouse
first and asking questions later because there are
statutory damages, and that is a powerful motivator
for class-action lawyers.
REED FREEMAN
WilmerHale LLP

Raul agrees that the CCPA is certain to trigger a lot of class actions. "That
is going to be a frightening financial prospect for a lot of companies
that themselves were victims of a crime if they cannot establish they had
reasonable data security," he says.

LEGISLATIVE WISH LIST
Tech companies clearly want Congress to preempt the state laws in any federal
bill that emerges. Consumer advocates do, too, but for different and opposing
reasons. With California Rep. Nancy Pelosi serving as speaker of the House,
consumer advocates would appear to have the upper hand here.
"I would love to see federal legislation preempt state legislation. That seems less
likely in this Congress because the California delegation, which is quite happy
with the California privacy law, is really not interested in having that preempted,
so that's going to be tough to get past," Wimmer says.
"The other way you deal with this is to have what I would call de facto preemption. If Congress were to deal with this relatively soon, it could have the effect of
having state legislatures that might be looking at passing a law say, 'Well, we've

OCTOBER 2019

*

WASHINGTON LAWYER

21



Washington Lawyer - October 2019

Table of Contents for the Digital Edition of Washington Lawyer - October 2019

Digital Extras
Your Voice
From Our President
Practice Management
Calendar of Events
Coding Out Implicit Bias With Ai
Rewriting the Rules on Data Privacy
Compromised Devices: Hardware Hacking Dangers
Taking the Stand
Member Spotlight
Global & Domestic Outlook
Worth Reading
Media Bytes
Attorney Briefs
Ask the Ethics Experts
Disciplinary Summaries
The Pro Bono Effect
Community & Connections
Last Word
Washington Lawyer - October 2019 - Cover1
Washington Lawyer - October 2019 - Cover2
Washington Lawyer - October 2019 - 1
Washington Lawyer - October 2019 - 2
Washington Lawyer - October 2019 - 3
Washington Lawyer - October 2019 - Digital Extras
Washington Lawyer - October 2019 - Your Voice
Washington Lawyer - October 2019 - From Our President
Washington Lawyer - October 2019 - 7
Washington Lawyer - October 2019 - Practice Management
Washington Lawyer - October 2019 - 9
Washington Lawyer - October 2019 - Calendar of Events
Washington Lawyer - October 2019 - 11
Washington Lawyer - October 2019 - Coding Out Implicit Bias With Ai
Washington Lawyer - October 2019 - 13
Washington Lawyer - October 2019 - 14
Washington Lawyer - October 2019 - 15
Washington Lawyer - October 2019 - 16
Washington Lawyer - October 2019 - 17
Washington Lawyer - October 2019 - Rewriting the Rules on Data Privacy
Washington Lawyer - October 2019 - 19
Washington Lawyer - October 2019 - 20
Washington Lawyer - October 2019 - 21
Washington Lawyer - October 2019 - 22
Washington Lawyer - October 2019 - 23
Washington Lawyer - October 2019 - Compromised Devices: Hardware Hacking Dangers
Washington Lawyer - October 2019 - 25
Washington Lawyer - October 2019 - 26
Washington Lawyer - October 2019 - 27
Washington Lawyer - October 2019 - Taking the Stand
Washington Lawyer - October 2019 - 29
Washington Lawyer - October 2019 - Member Spotlight
Washington Lawyer - October 2019 - 31
Washington Lawyer - October 2019 - 32
Washington Lawyer - October 2019 - 33
Washington Lawyer - October 2019 - Global & Domestic Outlook
Washington Lawyer - October 2019 - 35
Washington Lawyer - October 2019 - Worth Reading
Washington Lawyer - October 2019 - 37
Washington Lawyer - October 2019 - Media Bytes
Washington Lawyer - October 2019 - Attorney Briefs
Washington Lawyer - October 2019 - Ask the Ethics Experts
Washington Lawyer - October 2019 - 41
Washington Lawyer - October 2019 - Disciplinary Summaries
Washington Lawyer - October 2019 - 43
Washington Lawyer - October 2019 - The Pro Bono Effect
Washington Lawyer - October 2019 - 45
Washington Lawyer - October 2019 - Community & Connections
Washington Lawyer - October 2019 - 47
Washington Lawyer - October 2019 - Last Word
Washington Lawyer - October 2019 - Cover3
Washington Lawyer - October 2019 - Cover4
https://washingtonlawyer.dcbar.org/novemberdecember2021
https://washingtonlawyer.dcbar.org/julyaugust2021
https://washingtonlawyer.dcbar.org/julyaugust2021
https://washingtonlawyer.dcbar.org/marchapril2021
https://washingtonlawyer.dcbar.org/marchapril2021
http://washingtonlawyer.dcbar.org/novemberdecember2020
https://washingtonlawyer.dcbar.org/novemberdecember2020
https://washingtonlawyer.dcbar.org/septemberoctober2020
https://washingtonlawyer.dcbar.org/julyaugust2020
https://washingtonlawyer.dcbar.org/june2020
https://washingtonlawyer.dcbar.org/may2020
https://washingtonlawyer.dcbar.org/march2020
https://washingtonlawyer.dcbar.org/january2020
https://washingtonlawyer.dcbar.org/november2019
https://washingtonlawyer.dcbar.org/october2019
https://washingtonlawyer.dcbar.org/september2019
https://washingtonlawyer.dcbar.org/julyaugust2019
https://washingtonlawyer.dcbar.org/june2019
https://washingtonlawyer.dcbar.org/may2019
https://washingtonlawyer.dcbar.org/april2019
https://washingtonlawyer.dcbar.org/march2019
https://washingtonlawyer.dcbar.org/january2019
https://washingtonlawyer.dcbar.org/november2018
https://washingtonlawyer.dcbar.org/november2018
https://washingtonlawyer.dcbar.org/november2018
https://washingtonlawyer.dcbar.org/august2018
https://washingtonlawyer.dcbar.org/august2018
https://washingtonlawyer.dcbar.org/June/July2018
https://washingtonlawyer.dcbar.org/april2018
https://washingtonlawyer.dcbar.org/March2018
https://washingtonlawyer.dcbar.org/February2018
https://washingtonlawyer.dcbar.org/january2018
http://washingtonlawyer.dcbar.org/december2017
http://washingtonlawyer.dcbar.org/November2017
http://washingtonlawyer.dcbar.org/september 2017
http://washingtonlawyer.dcbar.org/september 2017
http://washingtonlawyer.dcbar.org/august2017
http://washingtonlawyer.dcbar.org/july2017
http://washingtonlawyer.dcbar.org/June2017
http://washingtonlawyer.dcbar.org/may2017
http://washingtonlawyer.dcbar.org/april2017
http://washingtonlawyer.dcbar.org/march2017
http://washingtonlawyer.dcbar.org/february2017
http://washingtonlawyer.dcbar.org/january2017
http://washingtonlawyer.dcbar.org/december2016
http://washingtonlawyer.dcbar.org/november2016/
http://washingtonlawyer.dcbar.org/october2016
http://washingtonlawyer.dcbar.org/september2016
https://www.nxtbookmedia.com