On January 8, 2019, the California Department of Justice, Office of the Attorney General, held the first of six public forums regarding the implementation of the California Consumer Privacy Act (CCPA). The CCPA, effective January 1, 2020, grants residents of California new privacy rights, similar to the European Union's General Data Protection Regulation (GDPR), which entered into effect May 25, 2018.

The one-hour forum included speakers representing consumers, employees, universities, and industry, including the Chamber of Commerce and the National Advertising Initiative. Public comments included concerns about the impact and scope of the law, as well as requests for clarity and modification.

Topics raised during the course of the forum included:

• Narrowing the definition of a "sale" of consumer personal data to reduce restrictions against interest based advertising (IBA) and narrowing the definition of "consumer" to exclude employees;
• How the CCPA should define "personal information," such as whether that information should include IP addresses and whether inferences drawn to create a consumer profile constitute personal information;
• Clarifying whether the $25 million annual gross revenues threshold, or the 50,000 consumer threshold to be considered a "business" covered by the CCPA applies to global revenues and consumers, or solely California revenues and consumers;
• Questioning whether the CCPA's grant to consumers of a right of access to "specific pieces of personal information" may require companies to collect and link data to individuals that would not otherwise be collected or linked, thwarting the principle of data minimization;
• Whether the Attorney General should establish safe harbors;
• The impact on user experience of a uniform opt-out logo or button on every webpage;
• Clarifying the requirements for offering a different level, quality, or price of goods or services and addressing the impact on loyalty programs;
• Contemplating the disproportionate adverse impact of offering a different level, quality, or price of goods or services on low-income populations who may be unable to afford to exercise their privacy rights by opting out of the sale of their information.

Pursuant to Section 1798.185, the CCPA gives the Attorney General rulemaking authority, with regulations to be issued on or before July 1, 2020, and requires the solicitation of broad public participation. As such, the Attorney General is hosting five additional public forums throughout California through February 2019. In addition, written comments can be submitted by email at privacyregulations@doj.ca.gov or by mail to the California Department of Justice, ATTN: Privacy Regulations Coordinator, 300 S. Spring St., Los Angeles, CA 90013.

Given the multitude of issues, including the uncertainty around whether the CCPA will align more closely with the GDPR and existing privacy regimes, businesses are likely to benefit from early compliance efforts. WSGR can advise clients regarding the effect of the CCPA on their business practices and will continue to monitor developments and provide updates. If you have specific questions on the impact of CCPA on your business or how you can prepare for the CCPA, please contact Lydia Parnes, Chris Olsen, Beth George, or another member of the firm's privacy and cybersecurity practice.