Senate Bill 294 (SB 294), also known as the "Personal Data Privacy Act," has sparked significant debate and interest in the tech industry and among privacy advocates. Proposed in early 2021, this bill aims to enhance consumer protection by offering Californians more control over their personal data. Let's dive into the key provisions of SB 294 and understand its potential impact on businesses and consumers.
SB 294 builds upon the existing California Consumer Privacy Act (CCPA), which became effective in 2020. The CCPA has set the benchmark for data privacy laws in the United States, and SB 294 seeks to expand its protections and address some of the CCPA's limitations.
New Categories of Sensitive Information
One of the significant changes proposed in SB 294 is the introduction of new categories of sensitive personal information (SPI). Currently, the CCPA covers identifiers, personal information, and internet activity. SB 294 introduces nine new categories, including racial or ethnic origin, religious or philosophical beliefs, union membership, sexual orientation, and processing biometric information.
These new categories aim to provide enhanced protection for consumers by offering them more control over highly sensitive data points that could be misuse or misappropriated.
Stronger Consumer Rights
SB 294 strengthens consumer rights by providing Californians with clearer opt-out options and expanding the right to know what data companies collect about them. It also grants consumers the right to correct inaccuracies in their personal information and limit its use for certain purposes, such as targeted advertising.
Additionally, the bill requires businesses to create and maintain a user-friendly mechanism for consumers to easily submit and respond to data rights requests.
Enhanced Penalties and Enforcement
To deter non-compliance and encourage businesses to prioritize data privacy, SB 294 proposes to significantly increase civil penalties for violations. Instead of the current cap of $7,500 per intentional violation, fines could reach up to $75,000 per intentional violation. However, they would remain capped at $2,500 per unintentional violation.
The bill also expands the enforcement authority of the California Attorney General by granting the AG the power to seek injunctive relief and permitting consumers to bring private lawsuits for data breaches resulting from a business's failure to implement reasonable security measures.
Expanded Territorial Scope
SB 294 seeks to broaden the application of data privacy protection by extending the reach of the act to cover more businesses. The CCPA applies to businesses meeting certain thresholds for annual revenue, data collected, or data shared. SB 294 would lower these thresholds, bringing more businesses under the scope of the law.
Moreover, the bill proposes to include companies that share personal data for commercial purposes, regardless of their location or industry. This change would significantly expand the territorial scope of data privacy protection in California.
Data Sharing and Sales Limits
SB 294 introduces new restrictions on data sharing and sales. The bill would require businesses to obtain explicit consumer consent before sharing personal data with third parties or service providers. It also mandates businesses to offer an opt-out mechanism for consumers who wish to limit data sharing.
The bill further clarifies that data "sales" include targeted advertising and requires businesses to inform consumers if their data may be sold and how they can opt out of such sales.
In conclusion, SB 294 represents a substantial effort to enhance data privacy protections for Californians. As the CCPA's enforcement date approaches, businesses should become familiar with the proposed changes and consider the potential impact on their operations. By doing so, they can better prepare for an evolving data privacy landscape and ensure compliance with emerging legal requirements.