Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / How CalPrivacy is Leading Privacy in the US E164

Transcript

How CalPrivacy is Leading Privacy in the US E164 · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  California was the first state and to come out with a
• 0:03
  comprehensive privacy law. That was in 2018 with the CPA
• 0:06
  passed by the Legislature. And then to your point, it was
• 0:09
  amended in 2020 by the voters to actually amend it.
• 0:13
  So California has always kind of historically taken the lead when
• 0:18
  it comes to consumer protection and definitely privacy is a
• 0:20
  great example of that. We're trying to make privacy
• 0:23
  easier for consumers. The first step is implementation
• 0:29
  of the California Delete Act and the delete request an opt out
• 0:33
  platform or drop. That's that single click
• 0:35
  mechanism. As of today, we have over
• 0:39
  270,000 Californians have signed up for the drop system.
• 0:44
  That's actually a pretty staggering number given that the
• 0:47
  deletion request don't have to be fulfilled by the data brokers
• 0:51
  until the fall per the statute, but that kind of shows a pent up
• 0:55
  demand. Hi, my name is Punit Patia and
• 0:57
  you're listening to Fit for Privacy podcast where AI meets
• 1:00
  privacy. This is not legal advice.
• 1:03
  Thanks for listening. California Privacy Protection
• 1:07
  Agency or Cal Privacy as we call it, is leading the way in the US
• 1:13
  and in the world on privacy matters.
• 1:15
  Now, what is their mandate? How do they see privacy?
• 1:19
  How does business react to privacy, especially in
• 1:22
  California, which is the hub of Silicon Valley?
• 1:25
  And what is the state of legislation overall in the US
• 1:28
  and in California? And how does California get to
• 1:31
  lead the way all the time? Well, these are all interesting
• 1:35
  questions and for those we have a very interesting person, Tom
• 1:39
  Kemp, who's also the director of Cal Privacy.
• 1:42
  So let's go and talk to him. And as we go, do check out Fit
• 1:46
  for privacy.com and grow skills dot store for your consulting
• 1:50
  and training needs. So hello and welcome to another
• 1:53
  episode of the Fit for Privacy podcast.
• 1:55
  And today we are with Tom Kemp, who's also leading the CCPA or
• 2:00
  how do we call it, California privacy agency CPA.
• 2:04
  Yeah, but we are, we just go by the nickname Cal Privacy these
• 2:08
  days. So it's the California Privacy
• 2:10
  Protection Agency is the full name and just call us Cal
• 2:12
  Privacy for sure. Cal privacy that's a wonderful
• 2:15
  way. So Tom, happy to see you after a
• 2:18
  long while. The last time when we spoke, you
• 2:20
  were about to publish a book. Now you're the heading this.
• 2:24
  Cal Privacy it's a wonderful transition.
• 2:26
  How does it feel? Oh, it feels great.
• 2:28
  Well, thanks again for having me on.
• 2:30
  Obviously, I didn't screw up the last time.
• 2:32
  So it's, it's good to see that I got invited back.
• 2:35
  But no, it's, it's been over a year in this role.
• 2:39
  And I'm really grateful for the ability to enable Californians
• 2:47
  to, you know, exercise their privacy rights and, you know,
• 2:50
  really try to, you know, provide guidance to businesses to better
• 2:56
  operationalized privacy and, you know, just make sure that we're
• 3:01
  doing a good job of enforcing the California Consumer Privacy
• 3:04
  Act. You sure are doing a very good
• 3:07
  job because from everyone I hear when we talk about the US
• 3:10
  privacy landscape, of course I like to have your opinion.
• 3:13
  California seems to be leading the way.
• 3:15
  Telephone California seems to be at the forefront of it.
• 3:18
  I've even heard stories like why they don't don't they make the
• 3:22
  CCPA and the CPRA the US law. But how do you see the state of
• 3:27
  privacy in US from your perspective, especially when
• 3:30
  you're talking to colleagues in other Member States?
• 3:33
  Yeah. I mean, unfortunately, the
• 3:35
  United States does not have a federal privacy law.
• 3:39
  And so it's really up to the states to come forth with
• 3:44
  comprehensive privacy laws. We're we're now at, I think, 20
• 3:48
  state privacy laws. And it's these laws have been
• 3:53
  passed in both blue states, IE Democratic states as well as red
• 3:57
  states. So it seems to be a concern for
• 4:03
  people of all political stripes to have privacy.
• 4:07
  The good news is, is that many of these privacy laws, in fact
• 4:11
  all the privacy laws share, I'm going to call it common bones.
• 4:15
  They, they, they're, they're pretty In Sync with each other
• 4:19
  in terms of the core business obligations as well as the
• 4:24
  consumer privacy rights. And so there, there is a, a good
• 4:28
  deal of consistency across the state laws.
• 4:31
  But to your point, certainly California was the first state
• 4:36
  and to come out with a comprehensive privacy law.
• 4:39
  That was in 2018 with the CPA passed by the Legislature.
• 4:43
  And then to your point, it was amended in 2020 by the voters to
• 4:48
  to actually amend it. So California has always kind of
• 4:51
  historically taken the lead when it comes to consumer protection,
• 4:55
  and definitely privacy is a great example of that.
• 4:58
  Yeah, I I'm very sure that you are doing a wonderful job, but
• 5:02
  I'm still curious to ask, how does California manage to lead
• 5:05
  it? I know you're the largest
• 5:07
  economy in the US amongst all the states, but how does it
• 5:11
  happen that California, which also has the Silicon Valley and
• 5:15
  which also tends to be like more innovative, is asking for a
• 5:19
  privacy to be at the forefront of it?
• 5:21
  And how does the Cal privacy then manage to lead the way?
• 5:25
  Well, I think it's kind of two main factors.
• 5:28
  The first factor is what I alluded to before that
• 5:30
  California has historically been a leader for over 100 years in
• 5:36
  terms of consumer protection. We were, you know, over 100
• 5:40
  years ago. We were, we led the nation when
• 5:41
  it came to food safety, clearly automobile emissions and
• 5:47
  environmental issues. So there's been a rich and
• 5:50
  robust history. In fact, Californian in early
• 5:53
  1970s actually put privacy as a ballot initiative into the state
• 5:59
  constitution. We were the first state to have
• 6:02
  a data broker law in the United States, the first state to have
• 6:05
  a comprehensive privacy law, and the first state to have this
• 6:09
  delete act, which provides the single click mechanism.
• 6:13
  And so that's that's just kind of historically what we've done.
• 6:16
  People sometimes call that the California effect.
• 6:20
  I think we're kind of a living, breathing embodiment of what
• 6:24
  Justice Brandeis A a person over 100 years ago who was a Supreme
• 6:31
  Court Justice, said that, you know, states should be the
• 6:34
  laboratories of democracy. And I think we kind of embody
• 6:38
  that. The second reason specific when
• 6:40
  it comes to privacy is that we have been the centre of
• 6:43
  technology with Silicon Valley and, and I think people are more
• 6:49
  in tune to the the positives, but also some of the the
• 6:52
  downsides of collection of our personal information.
• 6:58
  And the fact that even in the early 70s when we added that to
• 7:02
  the state constitution, there was a reference to the
• 7:05
  collection of, of information. At the time it was more focused
• 7:09
  on the the government collecting the information in the early
• 7:11
  70s. And you can imagine that coming
• 7:13
  out of the Vietnam War and the, you know, what the FBI was doing
• 7:18
  in terms of investigating civil rights, etcetera.
• 7:21
  But clearly, you know, I think the focus has shifted over the
• 7:24
  last 15 years to the surveillance business model for
• 7:30
  advertising that a lot of the large tech companies have here.
• 7:36
  And so I think people are just more in tune with that.
• 7:38
  But I, I, I want to say one last point, which is California with
• 7:43
  leading when it comes to consumer protection,
• 7:46
  specifically in the area of privacy and putting guardrails
• 7:50
  that we figured out a way to balance innovation.
• 7:53
  Since when the CCPA was passed in 2018 to now California has
• 7:59
  actually moved to the fifth largest economy in the world to
• 8:03
  the 4th largest economy in the world.
• 8:05
  So I think we can figure out and we have figured out and it's a
• 8:08
  constant struggle balancing guardrails and innovation.
• 8:11
  And, and, you know, that is something that we deal with here
• 8:15
  at the Cal Privacy Agency every day, making sure that we're
• 8:19
  protecting people, but making sure that we're not trying to be
• 8:23
  onerous when it comes to businesses and, and not trying
• 8:26
  to stifle innovation. That's wonderful.
• 8:29
  And you talked about the mandate of Cal Privacy and the mandate
• 8:34
  of Cal Cal Privacy also coming from the polls or the citizens.
• 8:39
  But how does it work? Because when we look at in the
• 8:41
  UK, there's the ICO, which is mandated by the central
• 8:45
  government. When we look at EU, there's the
• 8:47
  EDPB, then the states have their own and the member states sub
• 8:51
  states also have their own. So is it federal?
• 8:53
  Is it state who gives the mandate?
• 8:55
  Is it fully autonomous? How does it work in Cal Privacy?
• 8:59
  What's the mandate? Yeah.
• 9:01
  Well, I mean, obviously at the federal level there's sectoral
• 9:04
  laws such as Graham Leach Bliley, such as HIPAA that apply
• 9:10
  to personal information in the context of financial services or
• 9:15
  healthcare etcetera. Although those laws do not pre
• 9:21
  empt states from being able to go over and beyond and add some
• 9:25
  additional capabilities which California has done in the case
• 9:28
  of Graham Leach Bliley as well as HIPAA.
• 9:31
  But there isn't a comprehensive privacy law at the federal
• 9:36
  level. And states here in in America
• 9:42
  have the ability to pass laws where there's no moratorium or
• 9:49
  pre emption built into any federal laws.
• 9:53
  And you know, definitely the states have have moved forward
• 9:56
  with that. And so in our case, the
• 9:59
  California Consumer Privacy Act originally was going to be a
• 10:03
  ballot proposition, but then the legislatures saw in 2018 that
• 10:10
  there was all these breaches occurring.
• 10:14
  There was Cambridge Analytica that happened.
• 10:18
  And so the legislature basically said, OK, we'll take this over.
• 10:22
  And it was not a ballot initiative in 2018.
• 10:26
  And it passed unanimously through the Legislature and was
• 10:31
  signed into law by then Governor Jerry Brown.
• 10:35
  But then what happened in 2019 was that the industry decided to
• 10:41
  whack away at the California Consumer Privacy Act.
• 10:46
  And so the person, Alistair Mctaggart, who is one of our
• 10:49
  board members at Cal Privacy, decided to do a ballot
• 10:53
  initiative. He was actually involved in the
• 10:55
  initial ballot initiative and potential ballot initiative
• 10:58
  2018, but he came back in 2020 and came out with what we call
• 11:02
  the California Privacy Rights Act that amended the CCPA and it
• 11:07
  was put forth to the voters and 9.3 million people voted for
• 11:12
  Prop 24. And remember California as
• 11:16
  through the progressive movement for over 100 year has had the
• 11:20
  ability to have direct democracy through these ballot
• 11:23
  initiatives. And this is an example of it.
• 11:26
  And it passed with over 56% of the vote.
• 11:29
  So this really represents the first time in the world that
• 11:33
  privacy was put to the ballot. Obviously it was put to the
• 11:37
  ballot to add the the word privacy as a right in 1970s to
• 11:43
  add it to our constitution. But in terms of a comprehensive
• 11:45
  privacy law, this was really the first time in the world.
• 11:49
  And So what this ballot initiative did, it created an
• 11:53
  independent agency, maybe akin to something like the ICO or
• 11:56
  the, you know, other Dpas that you have in Europe.
• 12:01
  And it gave us 4 main capabilities.
• 12:05
  It gave us enforcement over the CCPA, which we share with the
• 12:09
  California Attorney General. It gave us the ability to write
• 12:13
  regulations. And the actual statue called for
• 12:16
  us to write regulations like in the areas of ADMT,
• 12:19
  cybersecurity, audits, etcetera, at which we've done.
• 12:23
  It gives us the ability to do public affairs so we can raise
• 12:28
  privacy literacy. It gives us the ability to do
• 12:32
  policy and legislation work to as an independent agency, to
• 12:36
  even sponsor legislation by working with an author in the
• 12:41
  legislature or work with other jurisdictions.
• 12:44
  And so we've actually have signed partnership agreements
• 12:47
  and relationships with the ICO, with CANIL in France, with the
• 12:51
  South Korean DPA, and we're part of this consortium of privacy
• 12:55
  regulators in the United States to make sure that we're
• 12:57
  harmonising our enforcement actions.
• 13:01
  And then finally, we have a 5th responsibility that was given to
• 13:04
  us by the legislature in 2023 with the passage of the DELETE
• 13:09
  Act that gives a single click mechanism for Californians to
• 13:14
  get their data deleted from data brokers.
• 13:18
  And that was tasked to the agency Cal Privacy to build.
• 13:22
  And I'm very proud that in January 1st of 2026, just a few
• 13:27
  months ago, that the drop system went live for consumers and
• 13:32
  we've had incredible turn out in terms of people signing up for
• 13:37
  the service and the deletions will occur.
• 13:40
  So we have 5 core responsibilities driven through
• 13:44
  not only the ballot initiative by citizens directly voting to
• 13:48
  give these, to create our agency and give us the ability to do
• 13:52
  these things, but then the legislature felt comfortable and
• 13:56
  confident enough to give us even more things to do as well.
• 14:00
  And so it's my job as executive director that reports into an
• 14:03
  independent board to run the day-to-day operations of Cal
• 14:08
  Privacy. And as I said before, I'm very
• 14:11
  fortunate to be part of a great team and working to expand
• 14:15
  privacy rights for Californians, raise privacy literature,
• 14:18
  literacy, excuse me, and also, you know, enforce and regulate
• 14:22
  the CCPA. Yeah, I think for the audience,
• 14:27
  it's very important to understand what you're talking
• 14:29
  about is the economical scale of your operations.
• 14:32
  Because when we talk about California as a state, people
• 14:36
  may think, oh, it's one of the states in the US, But end of the
• 14:39
  day, while you're 40 million people, you have an economy
• 14:43
  that's the size of Japan or India, and India has 1.4 billion
• 14:48
  people. It is many folds.
• 14:50
  And your economy is at the same level, 3.94 billion, four
• 14:54
  trillion, not billion. And that's the scale which you
• 14:56
  have to operate. And that's where you're ensuring
• 14:58
  privacy and data protection. And of course, what I wanted to
• 15:02
  ask is the new world AI, because privacy protection is also being
• 15:08
  damaged by the AI world. So in the state of legislation
• 15:12
  that you have right now, how are you incorporating or how is AI
• 15:17
  impacting it? Are you going to see some new
• 15:19
  laws? What is the state of legislation
• 15:22
  in context of what being it is? Is it going to change?
• 15:24
  Is it going to replace? Is it going to add?
• 15:26
  How? How do you see that?
• 15:29
  Yeah. So obviously California has, I
• 15:34
  don't know, I think 31 of the 50, you know, headquarters of
• 15:40
  the 50 largest AI companies, disproportionate number of AI
• 15:46
  startups are happening here in California too.
• 15:49
  So you very much to your point, you know, we're the 4th largest
• 15:52
  economy in the world, but only with 40 million people, right?
• 15:57
  And disproportionately the large tech companies and the AI
• 16:01
  companies which are really trying to build forth this
• 16:04
  fourth industrial revolution are headquartered here.
• 16:08
  And so we, you know, obviously as an agency that focuses on
• 16:14
  personal information, enabling privacy rights for consumers,
• 16:19
  ensuring business obligations, etcetera.
• 16:22
  You know, AI definitely touches upon personal information in a
• 16:27
  big way. I'm not saying all AI leverages
• 16:30
  personal information, but what we see with a lot of automated
• 16:33
  decision making that it to make critical life decision about
• 16:37
  employment, financial services and other aspects that it
• 16:43
  clearly touches upon the usage of personal information.
• 16:47
  So the mandate that we have through the voters and the
• 16:52
  underlying statute is that we regulate businesses that collect
• 16:59
  process personal information. So irrespective of the
• 17:03
  technology that is being used to do that stuff to personal
• 17:09
  information, we do have a we can regulate in that area because at
• 17:14
  the end of the day, it's the underlying personal information
• 17:17
  that citizens here in California, residents what we
• 17:21
  call in our consumers, you know, have a fundamental right to
• 17:27
  control its usage through right to delete, right to know,
• 17:31
  etcetera. And so therefore we can look at
• 17:36
  and do look at issues and areas as it relates to the use of AI
• 17:41
  and personal information. Furthermore, the statute gave us
• 17:47
  explicitly mandated that we create regulations as it relates
• 17:51
  to automated decision making involving the use of personal
• 17:55
  information. And so California has actually
• 17:58
  come up through through our agency here Cal Privacy has come
• 18:01
  up with the United States most comprehensive set of regulations
• 18:05
  as it relates to the usage of automated decision making,
• 18:09
  making critical life decisions based on personal information.
• 18:14
  And so through these regulations, we've given
• 18:17
  Californians additional rights that become effective January
• 18:21
  1st, 2027, the right to know that AIADMTS being used to make
• 18:27
  a decision, the right to opt out in certain circumstances and
• 18:31
  your rights to disclosure as well.
• 18:34
  So we have already moved forward with these regulations as it
• 18:38
  relates to AI that involves personal information.
• 18:42
  And we do look at enforcement actions involving personal
• 18:48
  information, which could include AI.
• 18:50
  Now, independent of that, the legislature here in California
• 18:54
  is, is very active in terms of looking at potential harms
• 18:59
  involving artificial intelligence.
• 19:03
  And I want to be very clear, in many cases that doesn't involve
• 19:06
  us. For example, you know, we don't
• 19:08
  regulate generative AI. And so there's been some laws
• 19:13
  passed here relating to AI chat bots relating to transparency in
• 19:21
  the generation of AI based images and transparency in terms
• 19:28
  of vendors having to document the where, where the sources of
• 19:34
  information are etcetera. So there is a robust set of
• 19:39
  legislation that's coming out of California regarding AI.
• 19:43
  And just like you know, we've taking a leadership and privacy,
• 19:47
  what we're seeing in California is significant leadership in AI.
• 19:51
  Now that has actually potentially sparked a backlash
• 19:55
  where maybe at the federal level there's discussions of, well,
• 19:59
  shouldn't the federal government have a comprehensive AI
• 20:03
  legislation and to what extent? Would that legislation override
• 20:11
  any state laws or place a, a ceiling versus a floor?
• 20:15
  And that's an ongoing debate that's happening right now.
• 20:18
  But given the absence of a federal law that what we see is
• 20:24
  not only California, but other states like Colorado with the AI
• 20:28
  Act and, and other forward leaning states, they're, they're
• 20:32
  coming out with their own AI legislation.
• 20:34
  And of course, we are doing AI as a it's the personal
• 20:37
  information per the actual statute.
• 20:40
  In that context, see something like the EUAI Act approach or do
• 20:45
  you see more like the UK Safety Institute approach for AI?
• 20:49
  How, how do you see that developing?
• 20:50
  Because you said there is a talk at the federal level, you said a
• 20:54
  couple of states have passed AI laws.
• 20:56
  And you also mentioned, if I understood well, that Cal
• 20:59
  Privacy has also added a few more rights like you mentioned
• 21:03
  right to delete, right for opting out and things like that.
• 21:06
  So which direction do you see the legislation going,
• 21:09
  especially with AI specifically? If I had a crystal ball, I would
• 21:15
  probably not be in this job and, you know, probably be placing
• 21:20
  stock bets or something like that.
• 21:22
  And but yeah, it's really difficult to tell.
• 21:25
  I mean, all I can say is is that states are moving forward.
• 21:31
  I mean we see it not only in Democratic run states, but
• 21:35
  Republican states. There's just significant
• 21:38
  concerns out there at the state level about AI and its impact
• 21:47
  specifically on kids. And and there is rumblings in
• 21:53
  terms of what could occur in Congress, but you know, who
• 21:58
  knows where it's going to of land.
• 22:00
  But what we're seeing is definitely, you know, move
• 22:05
  forward at the state level. We'll see if the federal
• 22:08
  government steps in can get agreement and we'll see to what
• 22:12
  extent that any legislation passed at the federal level is a
• 22:17
  ceiling where states can't go over and beyond or is a floor
• 22:21
  where states can go over and beyond.
• 22:23
  From our perspective, Cal privacy, our focus again is the
• 22:29
  usage, collection, sale, sharing, processing, etcetera of
• 22:34
  personal information that's well defined under our law.
• 22:38
  And, and obviously, if it's being used by automated decision
• 22:43
  making, we, we do have incredibly robust set of right
• 22:47
  of regulations and that becomes effective January 1st, 2027.
• 22:52
  And you know, we're already right now looking in the coming
• 22:56
  months to provide additional guidance to businesses in terms
• 23:00
  of what their obligations are, but it's all in the regulations
• 23:03
  as well. So we're moving ahead as it
• 23:06
  relates to what we're, we've been told by the statute, the
• 23:09
  states independently at a broader level, the federal
• 23:12
  government's looking at it. So again, it's hard to have a
• 23:15
  crystal ball in this area. And I I, I wish I knew but but
• 23:19
  I, I I don't. No, no, no.
• 23:22
  Again, I was looking at your perspective rather than a finite
• 23:25
  set of information. So you are definitely leading
• 23:28
  the way and you're definitely making impact.
• 23:30
  But do you also measure or have any initiatives to measure the
• 23:34
  impact or do you know, Yes, everybody says you're leading
• 23:38
  and yes, you are leading, but do you have evidence?
• 23:40
  Do you quantify? Do you qualify?
• 23:42
  Do you survey it? Is there something like that?
• 23:46
  Well, look, clearly what we're trying to do as a fundamental
• 23:56
  objective here at the California Privacy Protection Agency or Cal
• 24:00
  Privacy is we're trying to make privacy easier for consumers.
• 24:06
  So that's kind of a core objective that we have here
• 24:09
  because what we found is that at least in the notice and choice
• 24:15
  model or the opt out model that as Professor Salov has
• 24:22
  described, that exercising privacy rights is a never ending
• 24:27
  set of chores and it's very difficult to do it at scale.
• 24:31
  And So what we're trying to do is make privacy easier.
• 24:36
  And the first step in that is implementation of the California
• 24:44
  Delete Act, which was SB362 passed in 2023 and signed by
• 24:50
  Governor Newsom. And that led us to to implement
• 24:55
  the delete request in opt out platform or drop.
• 24:58
  That's that single click mechanism.
• 25:00
  So to answer your question, we very much look at kind of the
• 25:05
  consumer adoption here in California of the drop system.
• 25:09
  And I'm very pleased to say that as of today, which is the 10th
• 25:15
  of April, we have over 270,000 Californians have signed up for
• 25:22
  the drop system. You know, and the that's
• 25:26
  actually a pretty staggering number given that the deletion
• 25:30
  request don't have to be fulfilled by the data brokers
• 25:33
  until the fall per the statute, but that kind of shows a pent up
• 25:38
  demand. So that is one way that we can
• 25:41
  measure the actual success that we're having in terms of
• 25:46
  evangelising and having people exercise their privacy rights at
• 25:51
  scale. We've also very much focused on
• 25:55
  providing a set of robust tips to consumers to better enable
• 26:01
  and unlock privacy controls. And we've put that on our
• 26:06
  privacy dot.ca.gov website, which is where the drop system
• 26:10
  also resides and we've had great traffic to that website.
• 26:16
  And then the last thing in terms of making privacy easy is that
• 26:21
  we very much care about what's called the global privacy
• 26:25
  control or what we in California call the opt out preference
• 26:28
  signal. That's the ability to send a
• 26:31
  signal to a business to not sell or share the personal
• 26:36
  information. The issue is, is that a lot of
• 26:41
  the browsers don't support that out-of-the-box or on a mobile
• 26:45
  platform. You can't add an extension to
• 26:48
  enable that. And so I'm very pleased that
• 26:51
  last year that Cal Privacy was the sponsor of legislation by
• 26:58
  Assembly Member Loewen AB566, which was called the California
• 27:02
  Opt Me Out Act that requires browser vendors starting January
• 27:09
  1st, 2027 to add that capability, that feature to
• 27:17
  their browsers. And what we will do is through
• 27:22
  our regulations, we require businesses of certain size as
• 27:27
  well as data brokers to publish results about the number of opt
• 27:32
  outs that they have processed. And so another measure of
• 27:37
  success which we won't be able to see until 2027 is we'll be
• 27:42
  able through the submissions of the business again, either
• 27:47
  through the Delete Act submissions with data brokers or
• 27:50
  for the large businesses that have to publish their their
• 27:55
  privacy rights of exercising by consumers or DSA Rs statistics.
• 28:03
  We'll be able to see if we're actually being effective in
• 28:07
  terms of enabling more people to exercise their rights, including
• 28:13
  the opt outs as well. So we can quantify our success
• 28:19
  of making privacy easier. We're already seeing that today
• 28:22
  with the drop system. We're seeing that with increased
• 28:26
  traffic to our website with the privacy tips.
• 28:30
  And then starting in 2027, we'll get a better sense for our
• 28:34
  impact as it relates to opt outs.
• 28:38
  That's good to hear. I'm sure you're making that
• 28:41
  impact and if you quantify that, that's even better.
• 28:44
  I'm tempted to ask you because you mentioned you have an opt
• 28:47
  out mechanism. Now Europe has gone the opt in
• 28:51
  way and I see California as a leader in the privacy in US has
• 28:57
  chosen the opt out way. What's the thinking behind or
• 29:01
  the rational behind the opt out mechanism?
• 29:03
  Because the proponents of the opt in in the EU believe, but if
• 29:08
  it's an opt out, some data has already been collected and that
• 29:12
  should not have been collected. While opt out is more business
• 29:16
  friendly, that's what it's perceived as at least.
• 29:18
  And then the business has an option.
• 29:21
  And if an informed user wants to opt out, that's where the
• 29:25
  business has an advantage. So how do you play the two
• 29:27
  options? Yeah, I mean, I'm, I'm not a
• 29:31
  constitutional lawyer and I don't play one on this podcast.
• 29:35
  And I, I was not involved in 2018 in the drafting of the
• 29:42
  ballot initiative or the legislation for the California
• 29:45
  Consumer Privacy Act. But there was a concern
• 29:49
  expressed that a, that there could be some constitutional
• 29:54
  issues with an opt in and so the decision was made to stop
• 30:01
  potential legal challenges. That with the passage of the
• 30:09
  CCPA and signing by Governor Brown that the preferred and the
• 30:16
  safer choice was an opt out. Now there actually is carve outs
• 30:22
  for children and to have it to be an opt in and that's also at
• 30:26
  the federal level with COPPA or COPPA or however you want to
• 30:29
  pronounce it as well. So you can do that for kids or
• 30:34
  minors. But the decision was made,
• 30:37
  rightly or wrongly, to have an opt out model.
• 30:41
  And since then in the United States, all the other state laws
• 30:47
  have been an opt out. The good news is, is that at
• 30:50
  least as of now, there hasn't been any challenges to the
• 30:53
  constitutionality of these laws. So they've kind of stood the
• 31:00
  proverbial test of time. But we do realise, and this has
• 31:05
  been a great passion of mine personally, even before I took
• 31:10
  on this role, which is again in an opt out model where you're
• 31:16
  given this huge privacy policy and most people because they
• 31:20
  want access to the service, they just go ahead and say, OK, I
• 31:24
  accept. And so it's just too difficult
• 31:27
  for consumers to be able to fully exercise their rights that
• 31:33
  you now have a system in which that by default data is personal
• 31:39
  information is being collected by consumers.
• 31:42
  And So what we're trying to do is kind of in this model, how
• 31:46
  can we enable privacy rights exercising at scale.
• 31:51
  And, and the current kind of 1-2 punch that we have to do this is
• 31:58
  for 3rd party entities, which we call data brokers here in
• 32:03
  California. Those are businesses that you
• 32:05
  don't have a direct relationship with that collect your
• 32:07
  information and sell it to to third parties.
• 32:10
  What we're, what we require under statute, which is SB362
• 32:15
  that was built on a prior data broker registry law, is that it
• 32:19
  requires data brokers to register.
• 32:21
  And now we have 566 data brokers register an all time high.
• 32:28
  And once these data brokers register on top of that drop
• 32:34
  platform, we've built this system that provides a single
• 32:38
  click mechanism. And so right now Californians
• 32:41
  can spend 5 or 6 minutes verifying the residency, putting
• 32:46
  some basic personal information, hitting submit.
• 32:49
  And as I mentioned before, comes come the fall, August and
• 32:53
  beyond, the data brokers will have to start deleting the
• 32:56
  information. So that will partially address
• 33:00
  this issue by giving consumers a single click mechanism, which to
• 33:05
  be candid, it probably takes 5-6 minutes on average to to go to
• 33:08
  the drop system to enable privacy at scale in terms of
• 33:14
  deletions and opt outs from data brokers.
• 33:18
  And then we are going to as an agency come January 1st, 2027,
• 33:23
  heavily evangelised to Californians that they can turn
• 33:28
  on the global privacy control slash opt out preference signal
• 33:34
  in the browser to do not to enable, do not sell or share.
• 33:38
  And that will enable that signal to be sent to businesses that
• 33:42
  you have a direct relationship that you you interface with via
• 33:45
  a browser and and basically tell them not to sell or share your
• 33:52
  personal information. And we have a robust set of
• 33:55
  regulations associated with the GPC.
• 33:59
  And, and we're looking even for more public comments and
• 34:03
  potential new regulations if there needs to be clarification
• 34:06
  as it relates to the opt out preference signal.
• 34:09
  And we're going through that process now as well.
• 34:12
  So, yeah, it's, it's not a great model, you know, from a privacy
• 34:19
  purist. And so we're trying to enable
• 34:23
  privacy at scale in in this United States opt out mechanism,
• 34:30
  you know, but obviously on the if the opt in mechanism, you
• 34:34
  know, has led to cookie overload, right, you know,
• 34:37
  cookie fatigue as well. So I don't think either side has
• 34:41
  really figured out what the best model to go about as as well.
• 34:47
  But at least we're trying very hard.
• 34:49
  And I can point to the drop system, the incredible adoption
• 34:53
  that we've had and the future Opt Me Out Act requiring the
• 34:59
  browsers to change their settings to add a new setting, I
• 35:04
  should say, as proof points of at least we're trying to move
• 35:07
  the ball forward. Yeah, definitely you are.
• 35:10
  And I think there's no right or wrong model.
• 35:13
  It's just one way of doing things versus another way of
• 35:16
  doing things. And one thing is good that all
• 35:20
  the states in US have been consistent that it's an opt out
• 35:23
  model, not an opt in model. Otherwise it's very confusing.
• 35:27
  And do you have any feedback from businesses as well?
• 35:30
  Because especially in the EU, there's a little bit of noise
• 35:35
  saying in this legislation of the GDPR or the AI Act, these
• 35:39
  are killing innovation. While you are in the place where
• 35:42
  the innovation happens, how what feedback do you have from the
• 35:46
  businesses? Well, businesses are not afraid
• 35:49
  to be very vocal. And you know, the reality is, is
• 35:55
  that these businesses are headquartered in California.
• 35:59
  They, they have a lot of employees.
• 36:01
  They have significant impact on our economy.
• 36:06
  And you know that they are stakeholders that we should
• 36:10
  listen to. And we do listen to just like
• 36:12
  civil society groups, just like the legislature.
• 36:15
  But we also spent a lot of time talking directly with consumers
• 36:20
  and we have a consumer complaint portal.
• 36:25
  We've had already, in the couple years already over 10,000
• 36:28
  complaints submitted to us. I spent a lot of my time talking
• 36:33
  on podcasts to get, you know, to engage with people.
• 36:36
  But just yesterday I was at a Rotary Club and then a little
• 36:42
  bit later on I'm going to a senior centre to talk to senior
• 36:46
  citizens. So we have to always be
• 36:48
  listening to Californians be a business, be it citizens, be it
• 36:53
  the legislature, be it civil society groups, be it labour,
• 36:57
  etcetera. So we're open for business in
• 37:00
  terms of having conversations discussing this because we are
• 37:05
  trying to find that balance between innovation as well as
• 37:11
  providing the appropriate guardrails.
• 37:14
  I would say that California has done a pretty good job.
• 37:20
  I keep I'll reference the fact that we've gone since CPA
• 37:25
  passed, we've gone from the 5th largest economy to the 4th
• 37:28
  largest economy. The AI revolution is happening
• 37:31
  here in California. And I actually came from the
• 37:36
  private sector. I was CEO of a Silicon Valley
• 37:39
  company. So personally, I understand the
• 37:42
  business models. I, I have a good, I'm a computer
• 37:45
  science degree. We have incredible lawyers and
• 37:47
  technologists that understand artificial intelligence.
• 37:51
  And so we're we're we're in listen mode.
• 37:54
  But at the end of the day, I want to be very clear that we
• 37:58
  have to follow the statute, We have to follow the law and we
• 38:02
  try to strictly follow that. And that law is mainly has been
• 38:10
  delivered to us via the voters. And so this is what the voters
• 38:13
  wanted. And so I feel very good that,
• 38:16
  you know, I can always point to the fact that via popular
• 38:20
  initiative that the things that we are doing have been blessed
• 38:25
  by the voters directly as well and then further enhanced by the
• 38:28
  legislature. So and and again, even the
• 38:32
  Delete Act, you know, overwhelmingly passed in 2023,
• 38:37
  the Opt Me Out Act also overwhelmingly passed.
• 38:40
  Our legislature was signed by the governor that that required
• 38:43
  browser. So we do have a popular mandate
• 38:46
  for what we're doing, but we always have to be conscious and
• 38:48
  cognizant. We always have to listen and
• 38:51
  make sure that we're striking that right balance between
• 38:55
  guardrails and innovation. Absolutely.
• 38:57
  I think striking the right balance is what everybody's
• 39:00
  aiming for, whether it's you in the California, maybe other
• 39:04
  states in the EU and everybody. It's the balance between
• 39:07
  fundamental rights and the growth of business and
• 39:09
  commercial opportunities and also the innovation that we want
• 39:12
  to have to serve the society. But that's wonderful.
• 39:16
  And I, I think I would say again, you guys have done a
• 39:20
  wonderful job in California enough for privacy.
• 39:23
  And you particularly, I'm very happy to see that you're leading
• 39:27
  this initiative. So thank you so much for your
• 39:30
  time. Thank you so much for sharing
• 39:32
  your wisdom and all the best in the progress that you're making.
• 39:36
  And with AII think speed things will speed speed up.
• 39:40
  Well, thank you very much for having me on again.
• 39:42
  I'm, I'm, I'm pleased that I didn't screw up the last time
• 39:47
  that you felt good enough to have me back on and really
• 39:50
  appreciate the opportunity to talk to you, talk to your
• 39:54
  audience. Obviously, if you're in
• 39:56
  California and the Californian, you know, as defined as a
• 40:01
  consumer, you know, check us out at privacydot.ca.gov.
• 40:05
  You know, definitely do the drop system that's available right
• 40:08
  there. And feel free to, you know,
• 40:11
  always reach out to us here at Cal Privacy.
• 40:15
  And you know, we, we certainly want to make sure that we're not
• 40:19
  only engaging with consumers here in California, but the
• 40:22
  business community as well because we're, we're always
• 40:25
  trying to listen and learn. And make sure that as we talked
• 40:30
  at length, just trying to strike that right balance.
• 40:33
  And then by the way, that balance was actually called for
• 40:36
  in the actual Prop 24 as well. So that the, the, the voters
• 40:40
  wanted us to do that. And we're we're trying our
• 40:42
  hardest to to implement that. That's wonderful to hear.
• 40:45
  Thank you so much. Thank you for joining us on the
• 40:50
  Fit for Privacy podcast. We hope you found today's
• 40:53
  conversation valuable and thought provoking.
• 40:55
  Subscribe for more insights like this.
• 40:57
  If you enjoyed this episode, we'd appreciate that you'd share
• 41:00
  it and write us a review. For consulting, visit
• 41:03
  www.fitforprivacy.com. For certifications and training
• 41:08
  on ISO standards, visit www.growskills.store.
• 41:13
  You can also contact us for bespoke training for your staff
• 41:15
  and management. Until next time, stay safe, stay
• 41:19
  compliant, and grow your skills.