Though Election Day has spiraled into a nail-biting election week full of twists and turns, privacy proponents did see one small victory: This past Tuesday, Californians voted to increase data privacy protections by passing Prop 24, which mandates that businesses take more steps to keep consumer data safe.
“Prop 24 passing is a great sign. With a new administration, it’s a harbinger of potential federal legislation,” says litigator and tech entrepreneur Enoch Liang, who is working alongside Humanity Forward and former presidential candidate Andrew Yang on The Data Dividend Project, a movement dedicated to helping people take back control of their online data.
“Prop 24 is forecasting that Californians specifically, but Americans in general, are starting to wake up to how their data is being used and abused by tech companies.”
According to Liang, “Prop 24 is forecasting that Californians specifically, but Americans in general, are starting to wake up to how their data is being used and abused by tech companies. This awareness of what’s happening with our data and how tech companies are using it and exploiting it has become a wave of awareness that’s washing over all of America.”
Just two years ago the California Legislature passed the California Consumer Privacy Act of 2018 (CCPA), which granted people important privacy-related freedoms such as the right to know how their data was being used. Prop 24, which was filed by San Francisco-based real estate developer Alastair MacTaggart, builds upon the CCPA and tightens restrictions on how businesses manage your data.
Prop 24, also referred to as the California Privacy Rights Act (CPRA), resolves previously existing loopholes in the CCPA, specifically in its opt-out clause. “The CCPA allows consumers to opt out of the sale of their data by tech companies,” says Liang. “In response to that, tech companies said, ‘That’s fine, we don’t sell data. We only share data.’ Of course, you can debate whether or not they are actually selling data, but the CPRA makes clear that consumers can opt out of the sharing or the selling of their data, which I think is pretty important.”
Other improvements that Prop 24 makes to the CCPA include tripled fines for violations involving children’s information, as well the creation of a new category of data known as sensitive personal information, which includes health, race, ethnicity, sexual preference, etc. Under Prop 24, this sensitive personal information receives a higher level of protection.
Furthermore, Prop 24 ensures that the CCPA cannot be weakened or repealed. After being passed in 2018, the CCPA faced multiple measures that sought to weaken it. But because Prop 24 is a ballot initiative, it is only subject to amendment if it states that it is subject to amendment. In consequence, the legislature can amend Prop 24 only to enhance consumer privacy instead of further weakening it. In Liang’s words, “[Prop 24] sets a floor that the legislature can’t go below.”
Prop 24 also establishes the California Privacy Protection Agency, whose primary focus will be to enforce and implement state privacy regulations. In the eyes of acclaimed author and thinker Shoshana Zuboff (The Age of Surveillance Capitalism), this is both a practical and symbolic step towards reclaiming people’s data. As she writes in an article originally published in the San Jose Mercury News, the creation of this agency “sends a message to Washington that citizens are on the move.”
“Businesses are really going to have to step up their compliance game now that Prop 24 has passed.”
This agency is funded at a minimum of $10 million a year, which will allow the privacy rights agency to hire approximately 40 to 50 regulators. “That’s more regulators than the Federal Trade Commission privacy department, which regulates the entire country,” says Liang. “Businesses are really going to have to step up their compliance game now that Prop 24 has passed.”
Prop 24’s success suggests that Californians are no longer satisfied with how businesses, in particular big tech companies like Google or Facebook, are handling their data. However, the proposition did receive some backlash from organizations that criticized the bill for a number of reasons, including its use of a pay-for-privacy model and decision to have consumers opt-out rather than opt-in. Digital Lab at Consumer Reports responded to these concerns in an article on Medium.
As public consciousness turns towards the issue of data privacy, Liang’s belief is that implementing a successful solution is still very much a collaborative effort. “It takes a number of approaches to solve this problem,” he says. As Liang puts it, there are four major legs: (1) legislation and regulation, (2) technology solutions, (3) enforcement, and (4) grassroots education and awareness. “Like a chair, if a leg is missing, then you’ll have a problem,” Liang said. “Solving the data privacy rights conundrum requires all four legs to be there.”
But though these legs are all invaluable to the solution, Liang recognizes that everybody’s contribution will be different based on their unique skill sets. “These [legs] are all simultaneously happening,” he says. “The reason I focus more on legislation, regulation, and enforcement is because the Data Dividend Project was started by people who are strong in that space. I’m a lawyer, a lot of the advisors are lawyers, Andrew Yang was a lawyer, and so we want to focus on advancing the ball where we know how to advance the ball. If you asked me to go come up with a technology solution, it probably wouldn’t work very well.”
Kevin Nickels, Chief Product Officer of Atsign, believes that tech companies should employ trust-based solutions that enable privacy regulation compliance and transform people’s online experience for the better.
“So many solutions now are about adding more complexity to an already complicated issue. But the answer is actually terribly simple: Just be polite and ask for permission.”
“So many solutions now are about adding more complexity to an already complicated issue,” he says. “But the answer is actually terribly simple: Just be polite and ask for permission. If tech is going to truly do right by people, it has to stop grabbing their data and start respecting them instead. Prop 24 sends a clear message that the current status quo has to change.”
Now that Prop 24 has passed and the Presidential election is over, Liang maintains that the next big battle will be for federal legislation aimed at protecting people’s data privacy rights. He says, “With a new administration, there is a much bigger opportunity to get sweeping federal legislation passed, so I view that as the next big fight.”
—
Enoch is a California-based lawyer and entrepreneur, first founding a law firm (LTL Attorneys) and then helping start an artificial intelligence software company (LegalMation). Together with Andrew Yang, Enoch started The Data Dividend Project to help consumers collectively exercise their data rights and collectively bargain with tech companies.
