Proponents of a newly-proposed privacy initiative, the so-called California Privacy Rights Act (CPRA), claim to have enough signatures to qualify for the November ballot. The actual number of qualifying signatures may be close, based on my experience with previous initiatives.
But as someone who has signed a few ballot initiative arguments, I question whether this initiative should move forward at all. In the face of an unprecedented health and economic crisis, should the sponsors pull back their proposal?
I can think of three good reasons why the sponsors should wait.
First, we now have record unemployment, business failure, and state and local budget deficits. Almost every business I know has been touched in some way by the coronavirus, either because of the impact of “shelter in place” orders or because consumer purchasing patterns have changed dramatically. Many business owners have laid off or furloughed employees while some are still trying to operate bare bones operations. And many smaller companies have been forced to close their doors – hoping and praying that they will be able to reopen in the future.
Against this bleak backdrop, incredibly, the sponsors of the current law, the California Consumer Privacy Act (CCPA), are now proposing a new privacy regulatory regime. Ironically, the previous law has only been in effect since January 1, and the Attorney General’s office is on its third rewrite of the regulations. Business groups large and small are still confused about the language in the regulations, concerned about the scope of the requirements and unable to afford the cost of compliance. But regardless of the problems with the CCPA, the sponsors want to force a new set of business mandates and additional costs.
It is simply the wrong time to propose new mandates and costs on business. Business owners must focus on rehiring employees, restarting their business and a financial plan to get past the first six months, and Governor Gavin Newsom and the legislative leaders are focused on public health, economic recovery, wildfire protection, and homeless and housing programs. But the initiative sponsors seem to be locked into pursuing their initiative and other tone-deaf proposals that will discourage business recovery.
Second, the initiative creates a new state agency – just what we don’t need in a year when we are facing a $54 billion dollar budget deficit. With a shortage of state revenue for health, education and community assistance programs, this initiative and other proposals will create costly new government agencies. Obviously, those plans should be scrapped to allow government to focus on shoring up and stabilizing essential services.
The final reason this initiative should not go forward now — or frankly, any time in the future — is that it ties the hands future governors and legislatures. A “perfect” policy, whether by law or by initiative, is impossible to craft. The CPRA contains language that would prevent any legislative modification even if the initiative caused serious, lasting detrimental impacts. No initiative should limit the ability of the current Governor and the Legislature and future leaders to make changes.
Privacy law, in particular, is a relatively new policy area that is very complex and is changing rapidly due to changes in technology. This type of issue requires the legislature to adjust and improve the laws and regulations over time. In truth, the legislative process may take longer than I prefer, and often changes are less significant than I hope, but the legislative arena offers the opportunity to illustrate what is wrong with a particular policy and as well as a solution to fix it. This initiative destroys that process and sets a dangerous precedent for “freezing” policy without the potential for improvement.
The Governor, the Legislature, businesses and even privacy proponents share a common goal – an aligned and collaborative effort to protect the health of Californians while employees and employers find a way reopen and serve their customers. Privacy considerations and business success are not mutually exclusive, but now is not the time – and this is not the right initiative – for major changes to consumer privacy policy.