Photo: Gorodenkoff/Shutterstock.com

As companies are still preparing for what enforcement under the California Consumer Privacy Act could look like, in-house counsel should begin paying attention to the ballot initiative for the California Privacy Rights Act of 2020.

Following the passage of the CCPA last year, Alastair Mactaggart, a San Francisco real estate developer who founded Californians for Consumer Privacy, put forth the CPRA, also widely referred to as CCPA 2.0, to be put on the ballot in the November 2020 general election. The law expands on the CCPA and gives consumers rights over the use and sale of their data similar to the European Union's General Data Protection Regulation.

Rita Heimes, general counsel and data protection officer at the International Association of Privacy Professionals in Portsmouth, New Hampshire, said in-house counsel should begin to look to GDPR to understand how to comply with CCPA 2.0 if it makes it to the ballot.

"There is always an advantage to CCPA compliance if a company has been building data processing practices to GDPR standards," Heimes said.

In the CCPA 2.0, Heimes explained, there are provisions that encourage data minimization and require opt-in rights around the use of sensitive data. Right now, the CCPA only requires companies to allow consumers to opt out of using data. One of the big provisions in the proposed ballot measure, Heimes said, is how the amended version of the law requires transparency for artificial intelligence and decision-making tools that are often used in the personal lending and insurance industries.

"That would require more disclosure to consumers who are unintentionally caught up in those kinds of decision-making tools," Heimes explained.

Under California law, the organization will need to get 623,000 signatures on the petition by April 21 to be on the ballot in November. A spokesperson for Californians for Consumer Privacy did not respond to request for comment on how many signatures the initiative currently has. However, early in March, a spokesperson reported the organization had roughly 500,000 signatures. It is not clear if the new coronavirus has since stymied the organization's efforts to get enough signatures to make the ballot in November.

"I don't think anyone has any doubt that he'll [Mactaggart] be able to get it on the ballot this year," Kim Phan, a partner at Ballard Spahr in Washington, D.C., said in an interview.

Phan said her clients have not become too concerned with the proposed ballot measure. Although she noted she has been keeping a casual eye on it. Partially because even if it is passed, it will not come into effect until January 2023.

The delay largely comes because the law would create a new agency to enforce the law. She did say that COVID-19 could present an issue relevant to the CCPA 2.0 because the proposed law includes geolocation as a form of personal data. There has been a call from governments and businesses to track movements around the spread of the virus.