The biggest lobbying arm of corporations in California has filed a lawsuit seeking to delay enforcement of the California Privacy Rights Act (CPRA), the new law giving people control over the use of their personal data. And delay is nothing more than a denial of rights.
On the day the agency announced the law’s regulations going into effect, the California Chamber of Commerce asked a Sacramento Superior Court judge to force the state to hold off on enforcing the CPRA until at least July 1, 2023, on the grounds that the California Privacy Protection Agency (CPPA) broke the law when it didn’t pass regulations by July 2022.
The lawsuit is no surprise, as companies who directly benefit from the sharing and selling of our data are chamber members, including tech monopolies Google, Amazon and Meta, big banks such as JP Morgan Chase and the auto manufacturer Toyota. Those companies have also spread disinformation about the nature of privacy rights enshrined by the new law while pushing for a weaker, uniform federal law that would preempt California’s more stringent data protections.
But companies have known CPRA has been coming for a while. It’s been on the books for three months and won’t be enforced for another three. That might make it hard to convince the judge to delay enforcement.
The first round of regulations, meant to give more clarity surrounding the law, went into effect March 30. The regulations give consumers more bargaining power with regards to business’ use of their personal data. Consumers can prevent the use of sensitive data by first parties, and opt out of the selling or sharing of their sensitive information. Those businesses that buy, receive, or sell the personal information of more than 100,000 Californians, derive more than half of their revenue from selling personal information, or have a revenue of over $25 million, are now subject to the law.
The next round of regulations will encompass cyber security audits, risk assessments and automated decision-making. With algorithms and AI rapidly becoming a part of society, Californians can’t afford to wait for protections. Automated decision-making often relies on biased profiles that punish the most vulnerable members of society. The Equal Employment Opportunity Commission said in 2022 that 80 percent of businesses are using automated decision-making. However, 85 percent of algorithms throughout this decade will provide false analysis because of bias, according to the American Civil Liberties Union. Taking these two figures into account presents a frightening scenario of a society that chooses cost and speed over fairness.
Various industry groups who have submitted rulemaking comments to the agency believe the agency does not have the power to force companies to give consumers a right to opt out of automated-decision making. However, Consumer Watchdog strongly disagrees. We recently published a new report, “Unseen Hand: How Automated Decision-making Breed Discrimination and What Can Be Done About It” explaining the broad authority the agency has to draft regulations allowing consumers to know if they are being profiled by automated decisions, the logic that governs these algorithms, and the ability to opt out. We also urged the agency to align the regulations with Europe’s model data privacy law, the General Data Protection Act. Read the report and our letter to the CPPA here.
