- within Privacy topic(s)
- in United States
- with readers working within the Business & Consumer Services, Transport and Law Firm industries
- within Privacy, Government, Public Sector, Litigation and Mediation & Arbitration topic(s)
Happy CIPA Sunday folks!
California Senate Bill 690 (“SB 690”), which originally proposed sweeping changes to the California Invasion of Privacy Act (“CIPA”) has now passed both the California Senate and Assembly and is headed to Governor’s desk for approval. But after undergoing significant amendments, the bill that now sits before the Governor is a much narrower version of the CIPA reform that businesses were hoping for.
The final version of SB 690 is short. In fact, the bill makes just one substantive change to the Penal Code by amending only Section 637.2, prohibiting who may enforce CIPA’s pen register and trap and trace statute.
Sections 638.50 and 638.51 are California’s pen register and trap and trace statutes. A “pen register” captures outgoing electronic addressing information, such as URLs a user visits, while a “trap and trace device” captures incoming addressing information. Although originally intended to prevent covert government surveillance of communications-routing data, over the last few years plaintiffs have been invoking these statutes to challenge website tracking technologies. Both CIPA and the pen register/trap and trace statutes provide a private right of action, allowing individuals—not just government regulators—to sue for alleged violations and seek statutory damages.
The final amended SB690 applies only to California’s pen register and trap and trace statutes, §§ 638.50 and 638.51 and eliminates the private right of action for violations of those statutes. Instead, the final bill provides that only the California Attorney General may bring an action against a private actor for alleged violations of Section 638.51 arising from conduct occurring on an internet website, online application, or mobile application:
(d) (1) An action against a private actor for a violation of Section 638.51 alleged to arise from conduct occurring on an internet website, online application, or mobile application may be brought under this section only by the Attorney General.
The underlying conduct is not legalized. Businesses running websites do not receive immunity. Rather, private plaintiffs lose standing to bring one specific category of CIPA claims, leaving enforcement to the AG. So while SB 690 may knock out one category of CIPA claims, claims under Sections 631 and 632 are still viable for plaintiffs.
Importantly, the limitation on private enforcement applies retroactively to pending §§ 638.50 and 638.51 claims filed within two years before the bill’s operative date. Meanign if a business is currently facing a CIPA pen register lawsuit, the plaintiff may no longer be able to pursue that claim once the new law goes into effect if brought within two years of the operative date. But if the claim is brought under Section 631 or Section 632, SB 690 does not provide the same protection.
Under California’s legislative process Governor Newsom generally has 12 days after receiving a bill to sign or veto it. If the Governor takes no action within that period, the bill becomes law without the Governor’s signature.
If he vetos the bill, the Legislature has 60 calendar days to act on the Governor’s veto, and the veto can be overridden by a two thirds vote in both the Senate and Assembly. Most California bills that become law take effect on January 1 of the following year.
As always, we’ll keep an eye on this.
Xoxo
Queenie
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]