Right to Know CA Legislation

The EFF and ACLU of Northern California have helped California Assemblymember Bonnie Lowenthal introduce a new proposal called the Right to Know Act (AB 1291, PDF new window). The legislation is directed for customers wanting to know how much personal information is being disclosed to third parties from businesses that collect information for marketing purposes. Current CA law requires a response within thirty days of the names and addresses of the recipients of that information. This amendment would require the business to 1) provide to any customer, at no charge, a copy of that information, the names of contact information for all 3^rd parties that the business shared the information for the last 12 months, and 2) provide information regarding the privacy policy and avoiding disclosure of personal information. Violation of these provisions would constitute an injury to the consumer. It does not create additional categories of privacy.

The EFF considers this a much needed update to the transparency law for the digital age, since the previous version was tailored for direct marketing. For example, the previous statute does not mention location data, which is increasingly valuable as smartphones proliferate. The EFF suggests that because Europeans have similar sorts of access, companies already have the “systems in place to facilitate user access.” It does not acknowledge that importing these systems to the US could incur costs, through software installation or greater demands on consumer service requiring detailed responses (though I can see the second part of the bill being satisfied by a boilerplate description). It also does not access whether requests for personal knowledge will be affected by the bills passing.

Although California is at the forefront of consumer privacy in the US, the bill has just been introduced so there is no knowledge of its probability of passing or existing in a diluted form. Data brokers have been notorious in refusing to name information sources, even to Congressional caucuses (here's an example letter: PDF new window); Senate investigations have been fruitless and their responses have been general, with even one organization (FICO) denying they even are a data broker. Whether they exercise their lobbying power to combat this bill remains to be seen.