ABA's Letter to California Office of the Attorney General on California Consumer Privacy Act

The American Bankers Association appreciates the opportunity to comment on the proposed regulations to implement the California Consumer Privacy Act (CCPA). We welcome the Attorney General’s issuance of the proposed regulations, which provide some helpful clarifications of the law. However, we urge the Attorney General to consider the following recommendations to assist financial institutions, including banks, insurers and insurance producers, to comply with the CCPA, while helping to ensure that consumers' rights are protected in the manner the legislature intended.

Summary of Comments

In response to the proposed regulations, we highlight the following observations and recommendations, which are explained further in the proceeding commentary:

• The proposed requirements for verifying consumer requests should be revised in order to help prevent fraud while ensuring consumers can obtain financial services.
• The CCPA is intended to protect consumers' privacy, not to infringe on the rights of others; the final regulation should ensure that the CCPA does not apply to a business's intellectual property or require a business to reveal information that would infringe on rights of others.
• Financial institutions transfer sensitive personal information (PI) to service providers to provide products and services for customers; these transfers are not sales as contemplated in the CCPA, and the final regulations should include clarifications regarding "service providers" that do not burden these transfers.
• The proposed regulations include several new, burdensome and unnecessary requirements related to accepting and responding to consumer requests; these unauthorized requirements should be eliminated in the final regulations.
• The CCPA requires that a business notify a consumer if the business will use PI for purposes other than those disclosed before collection, however, the proposed regulations would transform the notice requirement into an explicit "opt-in" right for consumers; the final regulations should not include this unauthorized restriction on the use of PI.
• The proposed regulation does not adequately address concerns about the privacy of "household" PI and would permit a consumer to access the PI of others without consent or knowledge; the final regulation should delete "household" from the PI definition or provide procedures for a safe harbor for compliance.
• The final regulation should not include new and burdensome data collection and reporting requirements for businesses that handle PI of 4 million consumers annually.
• The Attorney General should issue model disclosure forms, the use of which is voluntary, that provide a safe harbor, to assist financial institutions in achieving compliance.
• The final regulations should provide guidance on a business's right to "cure" certain violations.
• The look back period for the right to know should be limited to the CCPA's January 1, 2020 effective date; a 12-month look back period should be imposed on requests to delete information, and should not be applied to PI collected before the CCPA's effective date.
• Businesses need adequate time to prepare for compliance with the regulations; the final regulations should establish an effective date of 18 months after issuance.
• Enforcement actions should be limited to acts or omissions occurring on or after the final regulations' effective date.