HANDS OFF THE DATA: California's new data protection law gives consumers greater control over their information.

• Author: Greenberg, Pam

Groundbreaking. Sweeping. Influential.

Those are a few of the adjectives used to describe the CCPA, the landmark data protection law set to take effect in January 2020. Formally known as the California Consumer Privacy Act, the law gives state residents the right to know what personal information businesses collect, sell or disclose about them and to opt out of the sale of that information to third parties, among many other provisions.

The law was drafted and passed very quickly in a compromise to stave off an even tougher proposed ballot initiative. It is the nation's broadest online privacy law, affecting companies across the country that do business with California residents, and is considered a bellwether for action in other states.

In more than half the states, lawmakers introduced some kind of consumer data privacy legislation this year--a substantial increase compared with previous years. In only a few states, however, did legislation pass.

Changes Coming

The California law was enacted in June 2018 and amended later that fall, but lawmakers, consumer groups and businesses agreed that it would need further work before its effective date.

More than a dozen bills amending the act were introduced this year. At least six had passed the Legislature and were waiting for the governor to sign at press time. The changes include technical corrections, exemptions and clarifications:

* The act does not govern the collection of personal information by employers.

* "Personal information" does not include de-identified or aggregate information.

* Information lawfully available in local, state or federal government records is exempt from the law.

* Certain business-to-business transactions and communications, as well as some types of information subject to the Fair Credit Reporting Act, are exempt.

* There is a limit on the law's private right of action so that a claim cannot be brought by those whose information was encrypted and redacted when breached.

The state also passed a new law that regulates data brokers who buy and sell personal information. It's similar to the first-of-its-kind law Vermont enacted last year.

Other States Act

Although legislation similar to California's was introduced in about 17 states this year, lawmakers mostly passed less controversial measures. Five states--Connecticut, Hawaii, Louisiana, North Dakota and Texas--for example, created privacy-task forces, councils or stuthes.

On some lawmakers' minds were the concerns of...