Washington Lawyer - October 2019 - 21

behind closed doors, we are not seeing how far these folks are along the road,"
says Michelle Richardson, director of the Privacy and Data Project at the Center
for Democracy & Technology (CDT), a nonprofit advocacy group. "Once major
proposals from the House and Senate leadership are out, I expect them to
move much more quickly."

THE 'GOLDEN' RULES
In the absence of a new federal law, and to the chagrin of tech lobbyists
in Washington, Sacramento has filled the void. The California Consumer
Privacy Act (CCPA) was passed quickly by the state legislature and signed
into law in June 2018 by Gov. Jerry Brown. The law takes effect January 1,
2020, but there will be approximately a half-year phase-in period as the
California attorney general sets the rules for its enforcement.
The law grants consumers a right to request that businesses disclose the
personal information they collect and how they use it. Consumers also
can request deletion of personal information and disclosure of the third
parties to which the information is sold or shared. Consumers can opt out
of the sale of their personal information, although businesses can offer
financial incentives to consumers to allow them to collect data.

The California law defines what is "personal information" broadly,
including a list of personal characteristics and behaviors, as well as
inferences that can be drawn from this information.
"What it generally does is it empowers consumers to have control over
how companies operating in California, which are businesses subject to
the law, collect, use, and share their personal data. It requires a lot more
transparency on the part of businesses, and it affords consumers a lot
more rights over what these businesses do with their data, to have data
deleted or corrected, or to say it cannot be sold," says Jeff Poston, cochair
of the privacy and cybersecurity group at Crowell & Moring LLP.
"If you are a company of sufficient size and reach and are subject to the law, it
will become your de facto privacy standard in the United States," Poston says.
"The CCPA is the privacy equivalent of the hula hoop. You can expect laws
to move east with the trend. You are going to see more states adopt
privacy laws."
Nevada and Maine have adopted data privacy laws that include features
like California's, although both are narrower in scope. For example, Maine's
act applies only to broadband internet access service providers. Other
states that are considering data privacy legislation include Hawaii, Illinois,
Louisiana, Maryland, Massachusetts, Minnesota, New Jersey, New York,
Rhode Island, Pennsylvania, Texas, and Washington, according to the
International Association of Privacy Professionals.
What has tech and other companies more worried is that the CCPA
provides for a private right of action by consumers against companies
that have been subjected to data breaches. That means there will be
class-action lawsuits, and no one knows yet how they will play out until
California courts have a chance to decide actual cases.
"It's basically a negligence standard," says Reed Freeman, cochair of the
cybersecurity and privacy practice at Wilmer Cutler Pickering Hale and
Dorr LLP.
"Beginning in July 2020 when enforcement takes effect, I would expect
that the breaches that are announced will be followed very quickly by
class-action lawyers trying to get to the courthouse first and asking questions later because there are statutory damages, and that is a powerful
motivator for class-action lawyers," Freeman says.

Beginning in July 2020 when enforcement takes
effect, I would expect that the breaches that
are announced will be followed very quickly by
class-action lawyers trying to get to the courthouse
first and asking questions later because there are
statutory damages, and that is a powerful motivator
for class-action lawyers.
REED FREEMAN
WilmerHale LLP

Raul agrees that the CCPA is certain to trigger a lot of class actions. "That
is going to be a frightening financial prospect for a lot of companies
that themselves were victims of a crime if they cannot establish they had
reasonable data security," he says.

LEGISLATIVE WISH LIST
Tech companies clearly want Congress to preempt the state laws in any federal
bill that emerges. Consumer advocates do, too, but for different and opposing
reasons. With California Rep. Nancy Pelosi serving as speaker of the House,
consumer advocates would appear to have the upper hand here.
"I would love to see federal legislation preempt state legislation. That seems less
likely in this Congress because the California delegation, which is quite happy
with the California privacy law, is really not interested in having that preempted,
so that's going to be tough to get past," Wimmer says.
"The other way you deal with this is to have what I would call de facto preemption. If Congress were to deal with this relatively soon, it could have the effect of
having state legislatures that might be looking at passing a law say, 'Well, we've

OCTOBER 2019

WASHINGTON LAWYER

Washington Lawyer - October 2019

Table of Contents for the Digital Edition of Washington Lawyer - October 2019