A strong California net neutrality may have been watered down by both Democrats and Republicans two weeks ago after lobbying by ISPs, but a new bill would take aim at both ISPs and edge providers when it comes to data privacy.
The bill, the California Data Privacy Protection Act, was introduced by by a pair of Democrats--Sens. Robert Hertzberg and Assembly member Ed Chau--and pushed by Common Sense Media with en eye toward protecting kids info online.
In the mode of a consumer "bill of rights" for privacy, the legislation includes the rights 1) to know what data is being collected, the right to opt out of the data collection, and the right to delete all their private data--akin to the "eraser button" that Sen. Ed Markey (D-Mass.) has long advocated for in national legislation, though he favors an "opt in" approach to allowing data collection, rather than the other way around.
The bill has a separate kids rights section, which does require opt in parental consent for the sale of data from "kids" under 16, allows for fines and lawsuits for data breaches.
The legislators are also billing it as "aligning" with the European Union's new GDPRdata privacy framework that went into effect May 25.
Common Sense says that the legislature is required to vote on the measure by June 28 and, if it doesn't pass, there will be a privacy initiative on the November ballot.
The bill comes in the wake of data breaches, sharing controversies (Facebook/Cambridge Analytica), increased focus on tech platforms in Washington, and the FCC's deeding of online privacy issues to the Federal Trade Commission, whose primary authority is enforcement rather than rulemaking.
The Center for Digital Democracy, which advocates for kids online privacy protections, is not fan of the bill as written, however.
"Rather than protecting citizens’ privacy, we are concerned that it will seriously undermine it," said Katharina Kopp, Director of Policy
"The proposed bill was clearly a rushed job and makes too many concessions to industry interests: for example, it removes a private right of action and it has many loopholes and exceptions, such as the exceptions to the right to deletion.
"Most importantly it would codify privacy discrimination against consumers who have opted-out of selling their data. Instead what we need is comprehensive privacy legislation that affords citizens and consumers privacy rights, imposes firm obligations on businesses, and establishes a data protection agency.
CDD supports the California Consumer Privacy Act ballot initiative because it will limit the selling and sharing of individual personal information by digital tech companies to third parties."