The California Attorney General (AG) has released new regulations, as part of a proposed rulemaking process to create procedures for facilitating consumers’ CCPA rights. While aimed at clarifying the CCPA requirements and providing compliance guidance, the proposed regulations raise question marks and concerns.
On Part I of our review, we discussed the challenges introduced by the AG’s proposed regulations for implementing the notices requirements under the CCPA.
Part II focuses on the financial aspects and the potential social impact that the CCPA will have, if implemented pursuant to the proposed regulations.
The Financial and Social Impact of the CCPA Proposed Regulations
- The Estimated Financial Impact
No doubt, the CCPA will have a financial impact on businesses. The extent of this impact is yet to be seen.
The AG’s Notice of Proposed Rulemaking includes interesting estimates about the financial impact of the proposed regulations.
The AG’s office is forming a CCPA enforcement task force. $4.5 million a year will be spent by the AG’s office, during the next two years, to hire 23 full-time positions and expert consultants to enforce and defend the CCPA. We are likely to see investigations led by the AG and potentially actions brought by the AG to California courts against violating companies, already within 2020.
The costs of compliance with the CCPA, between 2020 and 2030, are estimated by the AG at between $467 million and $16.4 billion, with an estimate of $25,000 spent by small businesses and $75,000 by larger businesses as initial compliance costs.
Jobs loss, as a result of the CCPA, is estimated at 9,520 by 2030.
There are no reliable estimates for the elimination or creation of businesses as a result of the CCPA.
The California AG acknowledges the potential significant adverse economic impact of the regulations on California businesses and their ability to compete with businesses in other states. Therefore, the AG invites the public to submit proposals to mitigate this impact.
- Financial Incentives are Less Appealing
The CCPA allows businesses to offer financial incentives, including payments to consumers as a compensation for using their personal information.
The CCPA also permits businesses to enter a consumer into a financial incentive program, subject to the consumer’s opt-in consent and the consumer’s ability to revoke the consent at any given moment.
The proposed regulations require a business, as part of the financial incentive notice, to notify the consumer of the consumer’s right to withdraw, at any time, of the financial incentive. This means that under the proposed regulations, the revocation of consent right is now enhanced in two ways:
- The consumers’ right apply not only to financial incentive programs. They will apply to any financial incentives;
- Revocation of consent is enhanced to withdrawal of the incentive – whether it is consent based, or only notice based.
The CCPA prohibits a business from using financial incentive practices that are unjust, unreasonable, coercive, or usurious in nature.
Adding this prohibition to the proposed ability to withdraw from any financial incentive anytime, may have a significant impact on how online services design their fee-based business models.
For example, online service providers will need to consider that a consumer could opt-out anytime from an incentive-based annual subscription and will be eligible for a pro-rated refund (otherwise, the incentive may be ‘unjust’ or ‘unreasonable’). The impact of this rule requires additional consideration and discussion.
- The Value of Personal Information
Businesses who provide financial incentives need to disclose the value of the data that underlines the financial incentive. They must also disclose the methods that they used to calculate the value.
This is another risk factor which may cause a chilling effect on businesses’ intentions to offer incentives, for a number of reasons:
- Often, actual data value is a matter for evaluation post-factum. For example, if a business uses personal information for a specific targeted advertising campaign, the business will have financial figures related to the success (or failure) of the campaign, only after using the personal information for that purpose. Ex-ante estimations would be speculative.
- The value of personal information could depend on multiple factors, some are outside of the business’s control and these factors may vary from one use case to another.
- Disclosing the estimated value and the assessment methods may require the business to reveal confidential financial information. Competitors which do not offer incentives may gain advantage over business who do.
- Privacy as Traded Goods and the Potential Social Impact
Under the proposed regulations, businesses may offer consumers with financial incentives as a compensation for the disclosure or sale of their personal data. The financial incentives must be reasonably related to “the value of the consumer’s data”. Businesses need to assess and determine that value.
The proposed regulations refer to the right to privacy as a proprietary right and put a price tag on that right, by setting requirements to measure the value of the consumer’s data, methods to calculate such value and instructions on how such value can be traded.
The regulations refer to the right to privacy as property that is out for sale and determine the value of that right.
Moreover, though the CCPA is a consumer protection law, the regulations focus on the businesses’ gain. They allow businesses to buy and sell consumers’ data by paying the consumers the data’s worth to the businesses. They ignore the consumer’s point of view and the value to the consumers from forfeiting portions of their privacy.
Past attempts to offer financial incentives as a compensation for the collection or disclosure of personal data (for example by AT&T) led to a public outcry. These attempts may have a significant social impact. They raise concerns that the business value of information related to consumers with a low level of income will be low as well and at the same time, these consumers may be the first to give up their privacy, to avoid paying extra fees for services.
The AG’s Notice of Proposed Rulemaking does not discuss the social impact of the CCPA regulations. We believe that this issue requires further discussion, to find ways to mitigate the potential adverse social consequences.
Conclusion
The California AG acknowledges the potential significant adverse economic impact of the regulations on California businesses and their ability to compete with businesses in other states. Therefore, the AG invites the public to submit proposals to mitigate this impact.
The regulations also pose a potential significant adverse social impact on consumers. Mitigation steps related to this potential outcome should be considered as well.
Read More:
Read Part I of the CCPA proposed regulations review about multiple notices requirements.
