20-page letter<\/a> to the lawmakers behind SB-1121, effectively a wish list of changes. While the suggestions weren't ultimately included in the draft that legislators will vote on this week, they're a clear sign of the battle in store for 2019.<\/p>\n'If these changes are permitted, a business could offer incentives that are unjust or unreasonable.'<\/p>\n
Mary Stone Ross, Privacy Advocate<\/p>\n
Among the most significant proposed changes was a reframing of who the law considers a \u201cconsumer." The bill as written applies to all California residents, a provision that industry groups wrote would be \u201cunworkable and have numerous unintended consequences.\u201d Instead, trade groups wanted the law only to apply to people whose data was collected because they made a purchase from a business, or used that business\u2019s service. They also proposed making it so that only businesses had the right to identify people as consumers, and not the other way around.<\/p>\n
Such a change might seem small, but it would substantially narrow the law\u2019s scope, says Mary Stone Ross, who helped draft the ballot initiative as the former president of Californians for Consumer Privacy. \u201cThis is significant because it [would] not apply to information that a business does not obtain directly from the consumer,\u201d Ross says, like data sold by data brokers or other third parties.<\/p>\n
Another major change sought to tweak disclosure requirements. Whereas the original bill requires companies to share specific pieces of data, the industry groups prefer to draw the line at "categories of personal information."<\/p>\n
There are other, subtler suggested changes, too, that Ross says would have sweeping implications. The law includes language that would prevent a business from discriminating against people by, say, charging them inordinate fees if they opt out of data collection. But prohibiting blanket discrimination is too broad for the business groups, who want to add a caveat specifying that they may not \u201cunreasonably\u201d discriminate. In another section, which discusses offering consumers incentives for the sale of their data, the industry groups also proposed striking the words \u201cunjust\u201d and \u201cunreasonable\u201d from a line that reads, \u201cA business shall not use financial incentive practices that are unjust, unreasonable, coercive, or usurious in nature.\u201d<\/p>\n
\u201cIf these changes are permitted, a business could offer incentives that are unjust or unreasonable,\u201d Ross says. Weakening these non-discrimination provisions, she says, could \u201cturn privacy into a commodity that will disproportionately burden the poor.\u201d<\/p>\n
On Tuesday night, during an Assembly hearing on the bill, the final sticking point, particularly for the tech giants, was the law's handling of data collected for the purposes of advertising. While the law prohibits users from opting out of advertising altogether, it does allow them to opt out of the sale of their personal information to a third party. But the industry wanted to create an exception for information that's sold for the purposes of targeted advertising, where the users' identities aren't disclosed to that third party. Privacy groups including the ACLU and EFF vehemently opposed the proposal, as did MacTaggart. They argued that such a carve-out would create too big a loophole for businesses and undermine consumers' right to truly know everything businesses had collected on them.<\/p>\n
"I was surprised they were this blatant, this early," MacTaggart says. "I expected this attack in 2019, but not in August 2018, two months after we passed the bill in the first place. "<\/p>\n
As of Tuesday night, the industry groups failed to get that amendment into the bill. But MacTaggart and others expect to fight this battle all over again next year.<\/p>\n
It's not that the privacy bill is perfect. The ACLU, for one, criticized the bill's exclusion of a provision in the ballot initiative that would have given people the right to sue companies for violating their data privacy rights. It instead leaves enforcement up to the Attorney General, except in the case of a data breach. In turn, attorney general Xavier Becerra proposed his own list of changes to the law in a letter last week, including the restoration of people's ability to sue.<\/p>\n
As the bill was being finalized, all sides did agree to some tweaks, like clarifying language that would protect data collected through clinical trials and other health-related information. Another change ensures that information collected by journalists remains safeguarded. And while the Attorney General didn't get everything he asked for, the legislature did agree to provide his office with an additional six months to implement enforcement regulations.<\/p>\n
The Electronic Frontier Foundation also concedes the law needs more substantive work. The organization wants to change the bill so that consumers would be able to opt into data collection, rather than opt out. The EFF also wants to ensure the law applies not just to businesses that buy and sell data, but data they share freely, sometimes at no cost to either party. That's how some app developers were able to gain access to tons of Facebook user\u2019s friends\u2019 data for years.<\/p>\n
'I was surprised they were this blatant, this early.'<\/p>\n
Alastair MacTaggart, Californians for Consumer Privacy<\/p>\n
And yet Lee Tien, senior staff attorney at the EFF, says the business groups' hamfisted efforts to jam so many changes through in a matter of months is counterproductive. "There will be battles over the definition of consumer and personal information, and we\u2019re prepared to talk seriously about those definitions," he says. "But that can't happen in any kind of responsible, grown-up way, in a short period of time."<\/p>\n
For now, all sides at least agree that SB-1121 is effectively a stopgap. The fact that big businesses didn't get their way this time hardly signals a resounding victory for privacy. Next year's legislative session will likely see new bills with even more serious changes proposed by influential industries. "They've got another chance to succeed, and they\u2019ll be back for sure," Baker says.<\/p>\n
"One of the reasons why AB 375 passed unanimously is everyone knew there\u2019d be a cleanup bill, and they had plenty of time to lobby to get their changes through," adds Ross, who opposed pulling the ballot initiative in June.<\/p>\n
Some engaged citizen, of course, could always mount another bid for a ballot initiative, but with the 2018 deadline already passed, that couldn't happen until at least 2020, and it would take millions more dollars to put up another fight. That's left activists like Ross and MacTaggart relatively powerless in the very battle they began.<\/p>\n
"I can talk to people and wave my arms around," MacTaggart says. "But the day I signed to give up the petition, I\u2019m like Cinderella back in a pumpkin."<\/p>\n
The only way to be truly secure on Facebook is to delete your account. But that's crazy talk! Here's how to lock down your privacy and security and bonus, keep targeted ads at bay.<\/p>\n
https:\/\/www.wired.com\/category\/security\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"![](\"https:\/\/media.wired.com\/photos\/5b807fa4385cec3f290b9763\/master\/pass\/SiliconValley-578551046.jpg\"\/)
<\/p>\n
Credit to Author: Issie Lapowsky| Date: Wed, 29 Aug 2018 14:27:57 +0000<\/strong><\/p>\nThe tech industry lobby has made it clear that they want changes to California’s sweeping privacy protections\u2014and they’ve got plenty of time left to get them made.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10378,10607],"tags":[714],"class_list":["post-13225","post","type-post","status-publish","format-standard","hentry","category-security","category-wired","tag-security"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/13225","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=13225"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/13225\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=13225"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=13225"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=13225"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}