What California’s New Data Privacy Law Means For You

Speaker 1: 00:00 Are you worried about what happens to your data on the internet? Well, a new law that went into effect at the beginning of the year allows Californians to ask businesses to delete their data or be fined. KPBS science and technology reporter Shalina Chote Lani spoke to businesses and consumer advocates for this story ever stroll through Facebook or Instagram and seen an advertisement for, well that thing you looked up on Google just two minutes earlier. Targeted advertisements are commonplace on the internet where human behaviors and preferences can be stored and potentially sold by tech companies. Emory Rhone, an attorney at the privacy rights clearing house in San Diego says identity theft data breaches and these advertisements are among the many concerns residents have brought up. Speaker 2: 00:48 Want them to have my information and now my debit card and my social security number and my driver's license are out on the internet. Apparently. What do I do and how did it get this bad? Speaker 1: 00:58 A March ACLU poll show, 90% of voters in the state support more consumer privacy protections from online technology companies and last year residents got that when legislators passed the California consumer privacy act, the legislation says consumers can request from certain larger businesses to know how their data is being used and ask those businesses to delete it or acid and not be sold. Rowan calls it a landmark piece of legislation, especially in terms of the steps consumers can take to protect themselves. Speaker 2: 01:29 Well now rather than saying freeze your credit or you know, take some remedial steps to try not to be low hanging fruit, we can say, look, why don't you go to that business, find out what information they have on you and then take that control back. Speaker 1: 01:43 The legislation has many businesses focusing on getting their data assets in order, but the legislation is fairly vague. So Justine Phillips, a San Diego attorney specializing in data privacy for businesses Speaker 3: 01:55 until CCPA was here, this was a wild West type world. You were allowed to amass data. Um, there was unregulated data. Now the definition of personal information under California consumer privacy act is really broad. Speaker 1: 02:10 She says, now businesses will have to figure out what data applies and whether they even fall under the scope of the law. For example, a business partner that's just providing software support to a larger technology company could be subject to the CCPA like ESET, a company that produces computer antivirus products. Alexandra ALB, Rose and executive there. She says, even though East set only collects a limited amount of data from its consumers, staff had to have lots of meetings on it, spend thousands of dollars and hire a consultant to get prepared. Speaker 3: 02:40 Well, first of all, I needed to educate myself on what, what is the act once I understood kind of what the act means, look at our business and the business model and how we communicate with our customers and put into place, uh, measures. Um, whether that is, um, changing things on the website or whether that's changing how our systems work. Speaker 1: 03:03 All bro says it's important to protect consumers privacy. So the company's happy to comply. But she says East side is a medium sized business. So larger companies may have had to do more. Speaker 3: 03:12 We need to keep certain amount of data to be able to conduct business. And the law had that in mind as well. So there are exceptions to um, deleting information. So while it's not gonna prevent us or other companies from doing business, it definitely is something where all the businesses have to think about, okay, what is it that we really need in order to, um, maintain business? Speaker 1: 03:41 ISA wasn't hit too hard, but Phillip says that may not be the case with other smaller Speaker 3: 03:45 companies. This is going to be a trickle down effect, uh, where the priority, uh, will be pushed down to organizations that may not just have the size, uh, to justify a large, uh, dedication of resources. And that includes many businesses in San Diego. Phillip says the city is home to a major tech industry, but despite the impending burden of data management, businesses will have to address consumer privacy rights. Attorney Emery Rowan says this is needed to happen. Speaker 2: 04:15 And for awhile we have arrived at a point where consumers around the world are waking up to the realities of what it means to exist in a big data world and they're pushing back on that. Speaker 1: 04:26 Both of these attorneys say they believe lots of California residents will exercise their new rights under this legislation. Joining me is KPBS science and technology reporter Shalina Chot Lonnie Shalina, welcome. Hey, glad to be here. What were some of the consumer abuses that led to this new law being passed? Um, probably the most famous one was the Cambridge Analytica scandal, uh, where it was found out that a company was taking a lot of data from Facebook and using that to make directed, uh, political advertisements online. Um, it was found out that one of the campaigns for Senator Ted Cruz, I was using that data. Um, during his campaign. Is this the first law of its kind in the U S uh, yes. I would say it's probably the first most stringent data protection law in the United States. And exactly what kind of personal information should consumers be asking these businesses about? Speaker 1: 05:26 Well, the law gives you the power to ask for any information, like your email address or your browsing history that you might have on social media, for example. Um, your credit card information, those types of personal data assets. There's government records that are online as well. Um, that actually there's this thing called a data broker. There are companies that take these, this data and use it to sell it to other companies that would want to do things like market certain products to you. One source I found said that it's like a $200 billion industry. So these are the types of data that they're looking for that you might just be online not realizing that you are contributing this information. Um, but it really does go a pretty far. Ken consumers start right now asking those kinds of questions and demanding that their personal information be taken down. Speaker 1: 06:21 They can and a lot of businesses have already been getting prepared for this law, which went into effect January 1st so if you're a online, you might notice that if you go to a website, it might come up with a disclaimer that says, Hey, if you want to continue using this service, by the way, we are going to be collecting this data. Do you agree with this or not? So a lot of businesses are already getting prepared for it because they know that consumers can start asking for that data. Now the connection between Googling something and then seeing an ad for it on social media happens without human intervention, right? I mean it's an algorithm. So our business is going to have to stop tracking on the internet. So what this law means is that if you are collecting lots of data online, if you are tracking data, you have to come up with ways to anonymize that data. Speaker 1: 07:10 Giving people the option if they say that they don't want their data to be able to be accessed by a data broker, like I mentioned. Um, they, these companies need to have the resources to be able to make that data not connected to your individual person or they have to be able to get into their database, take it out and delete it if you want that. So while those might be algorithms, the data that's being collected still exists somewhere in a database and these companies are going to have to figure out what to do with it. Um, get it in order in case consumers decide that they don't want it to be used. You quoted that huge number, what did you say? 200. So one source I looked at said it could be around a $200 billion industry where these companies, these third party companies are buying data from sources like let's say Facebook that are collecting massive amounts of data and then selling it to other companies. Speaker 1: 08:03 Um, it's so interesting. I looked at one chart and it has a, for example, video games that you might have or apps on your phone may be collecting data about your habits and then they might take it and then target that towards people who are experiencing depression or substance abuse or expecting mothers or um, compulsive buyers. Just by looking at the types of habits you have online. Um, it's like if you scroll through Instagram and you're, you were just talking about a pair of shoes that you wanted to buy and you see an advertisement about it. And so could this new law potentially have a big economic impact on business in California? Uh, so, uh, as I reported in my feature, it will definitely have an impact on businesses. Any business in California that is collecting data has had to, we'll have to spend thousands to tens of thousands of dollars to get their assets in order depending on what type of business you have. Speaker 1: 08:58 So I interviewed a business owner in San Diego, um, that didn't really collect that much personal data on people just email addresses in order to be able to operate. It was a malware product and they still had to spend thousands of dollars to figure out how to anonymize the data, make sure that they could get it in order to put it in the right places. So it will cost businesses money. Um, just just to even get prepared. And if you are a business that has a lot of data and consumers do decide that they want their data back and you don't comply, you can be fined. So that's another economic issue here. Now as consumers, we've already received a lot of information about companies changing their privacy policies and those announcements. They come in either dense pamphlets, you get the mail or internet scroll full of legalees that you can understand and you don't have time to read. Speaker 1: 09:53 Is that the way that we're going to be notified about our new rights under the California consumer privacy act? Well, I think it's going to be, like I said, these, these companies that do have interfaces online where consumers are directly browsing and putting in their information, they will probably have to have, um, a notice. Um, as soon as you go into the webpage, these are the terms of use. If you agree, then we will collect your data. The California consumer privacy act says people must not only opt in, but they have the right to opt out. I see. Okay. I've been speaking with KPBS science and technology reporter Shalina Chut Lonnie Shalina. Thank you. Thank you.