Four years ago, real estate developer Alastair Mactaggart spearheaded Proposition 24, which delivered better data privacy rights to Californians. Now he’s saying some of the rules implementing the statute are going too far.

Mactaggart, who is a member of the California Privacy Protection Agency, recently voted against a package of draft rules regulating AI and risk assessments companies will have to conduct surrounding the use of people’s personal information. California is in the process of drafting some of the first laws surrounding AI, algorithms and automated decisionmaking technology (ADMT), while Washington has stalled on making any meaningful inroads into the urgent matter. 

On March 8, the revised draft rules passed by a vote of 3 to 2, but it was the most divided the privacy agency has been in its short, three-year existence. The dispute mostly centered around what will be considered an automated decision and what businesses would have to report to the agency. 

After some re-working, the new definition for ADMT now reads as, “any technology that processes personal information and uses computation to execute a decision, replace human decisionmaking, or substantially facilitate human decisionmaking.”

It was those last four words, “substantially facilitate human decisionmaking,” that sent the board down an hour-long discussion about the law’s perceived strength or weakness.

Looking at the definition, Mactaggart said even if a person is examining a loan and various computational outputs, it will be considered an automated decision, when it’s really not. 

“And that’s crazy. I can’t possibly support that,” he told the board. In his eyes, the language drifts from the statute, and goes beyond Europe’s data privacy law.

The ADMT definition is simply too broad, would encompass all software, and worked against privacy rights, contended Mactaggart.

But others saw it completely differently. Board member Vinhcent Le, who worked on the ADMT regulations, felt the revised ADMT wording put privacy rights on shaky ground, and that “substantially facilitate human decisionmaking“ opened up a potential loophole. 

“I was a little unhappy with some of the changes,” said Le. “I think that is a bit of a potential loophole. This is an area that we should really focus on making sure this doesn’t become a big loophole because companies can claim their ADMT didn’t substantially facilitate a decision.”

For example, a company uses ADMT to generate a score about a consumer that the human reviewer uses as a primary factor to make a significant decision about them. But what if a company argues it’s actually the human that made the decision? The dispute could come down to what “primary factor” means. 

At one point, board chair Jennifer Urban interjected, stating that not any decision would fall under the scope of the law.

“Significant decisions. Not every decision,” she said.

Those significant decisions give narrower guidance on the law, presenting Californians with protections surrounding their personal information when it comes to getting certain loans, school enrollment, criminal matters, jobs, and healthcare. 

Mactaggart responded. “I feel like what we’re saying is, ‘everybody who is involved in it.’”

Le said those were critical areas that needed to be reined in the most. 

“Isn’t that where we should have stronger rights as Californians, to know how these decisions are made? Especially for folks who are trying to move up the ladder who’ve felt the system has worked against them?”

“No one is arguing against a just society. I think we’re getting far afield from privacy,” responded Mactaggart.

Jeffrey Worthe, also a real estate developer and the newest addition to the board, voted in favor of advancing the amended rules.

“It’s time to move this to a wider audience.”

Lydia de la Torre, an outgoing board member, voted against the rules, also saying they went beyond the scope of the board’s authority. 

“If we go beyond the scope of our delegation we will find ourselves in a situation where we will face extensive litigation after significant effort to enact rules through the formal process, and we could lose not only the rules but potentially the delegation given to us by voters.”

Urban, who voted to advance the draft rules, said, “This does tend to feel like it has more loopholes than it did last time that I am somewhat skeptical about, but I would like to see what kind of comments we get.”

The formal rule making process has not begun, but is expected to get underway over the summer. Any final rules probably won’t be final until early 2025.

Speaking during the meeting, CPPA Executive Director Ashkan Soltani said that he would like to see more comments regarding the regulations come from the average consumer.

“One thing that I have regretfully seen…90% of those comments were made from lobby groups and some advocacy groups, but a lot of industry groups,” said Soltani. 

“We hope to receive input from the public writ large because this is an area that affects everyone, not just businesses but consumers and how they experience the world.”