The Everchanging CCPA

In this episode, Peter Stockburger of Dentons, shares his thoughts on critical elements of the CCPA. What are some of the topics we touch on? - revised regulations, Do Not Sell requirements, the necessity of data inventories, and how the CCPA cannot be used as a predicate for other claims, such as state or federal unfair trade practices. Paul and K then discuss some differences between the CCPA and GDPR.  

Contact us at SeriousPrivacy@trustarc.com with comments or suggestions.

If you have comments or questions, find us on LinkedIn and Instagram @seriousprivacy, and on BlueSky under @seriousprivacy.eu, @europaulb.seriousprivacy.eu, @heartofprivacy.bsky.app and @igrobrien.seriousprivacy.eu, and email podcast@seriousprivacy.eu. Rate and Review us!

Subscribe today HERE

Back the Board Game! 
https://www.kickstarter.com/projects/seriousprivacy/serious-privacy-the-data-game

Powered by TrustArc

From Season 6, our episodes are edited by Fey O'Brien. Our intro and exit music is Channel Intro 24 by Sascha Ende, licensed under CC BY 4.0. with the voiceover by Tim Foley.

Transcript

Copy Transcript Copied

Paul 0:49

Welcome to this week's episode of Serious Privacy. Today you will listen mostly to a conversation that K had with Peter Stockberger, who is one of the lawyers at Denton's in San Diego. K and Peter spoke on the 24th of February, the last day, that comments could be submitted on the new guidelines for the California Consumer Privacy Act. And surprise, surprise, the CCPA is exactly the topic that Peter and K will be discussing. What is going to happen with the implementation of CCPA? Are organizations already starting to understand their requirements? What is happening in terms of purpose limitation and the sale of data? And what is happening with the penalties that could start to fall somewhere after the 1st of July of this year? All of that you will hear in the conversation between K and Peter. And after that, K and I will discuss a little bit of what we found remarkable in this conversation. Have fun.

K 1:51

This is K Royal with Serious Privacy, and today I am bringing you a session with Peter Stockberger of Dentons. He is a partner in their employment and the data privacy and cybersecurity group. And what I really, really love about Peter is he is phenomenal in his experience. If you go look at it, the full thing is online at dentons.com. If you look up Peter Stockberger, and one of the things he did is he was in the office of the prosecutor for the United Nations International Criminal Tribunal for the former Yugoslavia. Okay. Pretty impressive. But he still continues to work uh actively in pro bono, which is near and dear to my heart. So I love. And so I met Peter, oh my gosh, probably only within the past couple of years, and I'm not sure we've actually met in person.

Peter Stockberger 2:44

That's right.

K 2:45

Okay, so we'll have to make sure that we actually meet in person at some point. But the most important question of the day, Peter, no, I did not warn you on this one because I tend to do this when I moderate panels, is I have to ask you a very personal question. And I usually just pull it straight out of the, you know, the woodwork here. No warning whatsoever. Are you a night person or a morning owl?

Peter Stockberger 3:07

I am absolutely 100% a morning owl.

K 3:11

I just said morning owl, didn't I? It definitely just comes out of the blue.

Peter Stockberger 3:16

Yeah, if you catch me anytime past 10 p.m., uh I won't be functioning well. But uh I'm usually up around four or five in the morning working, and that's uh largely because prior to practicing law, I used to produce a morning radio show on uh AM radio in Austin, Texas, KLBJ. And so I was up uh every morning during undergrad from 3 a.m. to noon uh running a radio program. So it's just been sort of ingrained in me to be up at the crack of dawn working.

K 3:49

Oh, that is fascinating. Are you from Texas?

Peter Stockberger 3:53

No, I'm originally from New York and then moved out to California for a bit and then went to uh undergraduate school and a bit of graduate school in Texas, lived in Austin for a while, and then moved out to San Diego for law school.

K 4:09

Love it. Now, Austin is fantastic when you talk about technology, it is one of the fastest growing mechas there are for technology. I've got several friends in Austin, and I have to tell you, it's it's kind of it's not a Silicon Valley, but it is a huge um explosion of technology and startup companies.

Peter Stockberger 4:28

Yeah, it's got it's undergone a huge transformation from when I went to school there. I mean, Austin was a relatively small town. The the catchphrase there is keep Austin weird. And every time I go back, it's just booming with tech companies. You know, they have a JW Marriott downtown, so you know you've made it.

K 4:49

Right. And I've stayed at that JW Marriott both when they had the Association of Corporate Council there and when they had IAPP there. And I think IAPP is headed back there this fall. Is that right? I think so, yes. I'll have to look that up. So we may actually meet in person when it comes to that. So, okay, today's session is about the California Consumer Privacy Act, the CCPA, which um I believe the status of their comment period is over today, right?

Peter Stockberger 5:20

That's right. The new proposed modifications to the implementing regulations by the California Attorney General, public comment uh ends today on those proposed modifications.

K 5:32

And and by today, if you're listening to this in future time, and it probably I won't publish it today, means Monday, February the 24th of 2020. So let's talk a little bit about the CCPA. I know I wanted to get someone on here with a lot of good uh experience and insight into the CCPA because this is a topic that's hot for a lot of people right now. So update me on the status, other than the final day for comments is February the 24th.

Peter Stockberger 6:01

Sure. So the CCPA was signed in 2018 and took effect on January 1st of this year. So the law itself is in effect and applies. There were a number of amendments that got signed into law last October. Those are also in effect. So we know the statute itself is in effect on January 1st. What's open, what's a missing piece right now are the implementing regulations that have been proposed by the Attorney General's office. And the Attorney General is charged under the CCPA with issuing regulations that further define areas under the law, set forth the standards for the notices and privacy policy, and generally put the meat on the bones of the areas of the statute that are a little ambiguous.

K 6:53

Are there areas of the statute that are a little ambiguous?

Peter Stockberger 6:57

Yeah, that's definitely an understatement. There are, you know, for example, there's an area in the statute for the request to know, the request to delete that say the consumer must submit a verifiable consumer request. Now the statute didn't define that phrase. So there's a lot of ambiguity about what that meant. What does it mean to verify somebody's request? The AG regulations, the draft, came out in October of last year and they propose a number of standards for verification. For example, if somebody's submitting a request to know what data you have on them. The proposed regulations say if it's only a request for categories of information, you've got to match at least two data points in the request with at least two data points in your system. So it gives some parameters around how you can verify identity. But those draft regulations are still draft. They came out in October. The Attorney General indicated at the end of last year that they were going to try to make them final by the first of this year to align with the statute's effective date. That didn't happen. They didn't become final in January. In fact, no word from the Attorney General in January. And on February 7th, as we were all waiting for the regulations to become final, the Attorney General issued new changes to the draft regulations, and those are what are still open for public comment through today, February 24th. So we're in this odd scenario of the law is in effect, but a majority of how the law should be implemented is still being discussed and is still in draft form.

K 8:30

So if a company was not compliant with CCPA right now, let's say for something as such as having their privacy notice updated for uh categories of where they share data to. We'll get to the do not sell here in a little bit, but let's say their privacy notice is isn't updated right now. Would they get in trouble?

Peter Stockberger 8:52

Uh they could, in theory. So the the law says that the attorney general is the only body that can enforce a majority of the law, including the privacy policy and privacy notice requirements. However, the attorney general cannot enforce the law until six months after the regulations become final or July 1st, 2020, whichever comes sooner. And so at this point, because the regulations are not yet final, July 1st will be the earliest date that the AG can begin enforcement. So, and the AG came out at the end of last year, at the beginning of this year, and said even though we we can't start enforcement until July, it's not a safe harbor period between January 1 and July 1. And we will look back to January 1 for companies to see if they were in compliance. However, we will look kindly on companies that are actively seeking to comply. So I think you know the risk right now, if a company is not in any compliance and is not working on compliance, uh, the risk is low in terms of an immediate enforcement action because the enforcement action can't come till July. So if you if you become compliant in the next month, let's say, uh, how likely is it that you're going to be on the radar of the AG come July? It's hard to tell. The real risk, though, comes in where you have to provide certain notices before you can collect or use data. So, for example, the law requires a company to put in a notice at collection that tells the consumer, that tells the California resident what categories of information you're going to collect and how you're going to use it. And the AG regs say that you cannot use that data for any other purpose other than what you disclosed in that notice. So, in theory, right now, if you are not providing that notice and you're collecting and using data, you're in violation of the CCPA. And come July 1st, if the AG comes knocking, even if the AG gives you a 30-day right to cure, which it must do before it can bring an enforcement action, if you've been collecting and using data without notice for months, I'm not sure what the cure would be at that point. Um there is there is some risk in terms of how the how data is being collected and used right now.

K 11:15

And when we talk about that notice to cure, I'm going to pick up on that one because I hear a lot of people they just scoff at this. Well, you can't cure something. Um, I I don't agree with that. I believe there is a way of being able to fix something if it's identified as wrong, even if it's a breach per se. Um, what's your thoughts on the 30-day cure period?

Peter Stockberger 11:38

Well, I think there are two kinds of cure periods that are at issue in the statute. The first is the AG enforcement action cure. So the law says before the attorney general can bring an enforcement action, it has to give notice to the company and give 30 days to cure. And for a lot of parts of the CCPA, that that seems pretty straightforward. For example, if your privacy policy is not updated, that's easy, that's a pretty straightforward cure. The part that's not straightforward and a little complicated is well, what about the use and collection of all the data that came in before you provided those notices? How do you cure the lack of notice for that data collection? There may be a scenario where you have to go back and obtain opt-in consent from everyone you've collected data on. And that's implied in the new proposed AG regulations. They say if you're gonna use data beyond the purpose for which you've provided notes, you have to obtain opt-in consent from the consumer. Now that's in the draft, we don't know if that's gonna make it into the final, but that's one area where the cure issue gets a little complicated. That's on the AG enforcement side. There's another cure provision, and that's in the private right of action part of the statute. And the private right of action part of the statute says an individual consumer can bring a lawsuit in the event of a negligent data breach. However, there's a right to cure period. So before they can bring the lawsuit, they have to provide the ability to cure. Now, it's a little unclear on how you can cure a negligent data breach if the individual's data has already been exposed. I I agree with you, K. I think there are probably some scenarios where you can issue you can undertake some remediation efforts. You can obviously secure your systems, you can plug the hole where the breach occurred, you know, you can you can make all those steps. Now, if there's been exposure of data or acquisition, I think it gets a little more complicated how you can cure that. Um, so I think that's going to be heavily litigated when the lawsuits start coming in and we see some court decisions.

K 13:45

So on the heavily litigated portion, I love this because I'm one of these um call it chicken little syndrome, whatever, but I sit here and I look at this statement of we don't sell consumer data that companies have to put in their privacy notice under the very, very broad definition of sale under CCPA. If they disclose data, they have to say what categories of third parties they disclose data to. Now, disclosure would be to service providers specifically defined under CCPA as those where you have a contract in place where they're not allowed to use the data for something else. But the other part where if they sell data under the very broad definition of sell, they have to disclose the categories of third parties that they sell data to. If they don't sell data, they have to affirmatively state in their privacy notice that they don't sell data. Now I can't see any company having to state they don't disclose data because most companies disclose data to someone, even if it's just, you know, Microsoft or email. But let's say they uh put in there they don't sell personal data. To me, that brings it under the um, in most cases, under the just uh jurisdiction of the FTC for perhaps making a false claim in a public notice. And we know that the FTC has been very active at enforcing uh false claims. So, what do you think about this affirmative we don't sell personal data?

Peter Stockberger 15:13

Yeah, I think that part of the law can bring in a number of legal issues. To your first point on whether saying something in your privacy policy that is not true, uh, what legal liability does that bring up? You're right, that could raise issues under the FTC Act for unfair business practices, and we've seen the FTC enforce those type of actions. It also can be used uh as a as a basis for a lawsuit under state law for unfair business practices. So most states, including California, where I practice, have a sort of FTC equivalent. Um, you've also we've also seen lawsuits brought for breach of contract, alleging that the privacy policy is a contract and therefore it was a misrepresentation of fact that induced the person to enter the contract. So a number of potential legal issues. The the interesting quirk in this whole scenario is that the CCPA expressly says, and this is in the statute, that the CCPA should not be used as a legal predicate for any other legal claims. And so uh many observers believe that that provision in the law is meant to prevent the CCPA from being used for unfair business practice claims. Now we haven't seen it tested yet in a court.

K 16:32

I was gonna say, do you believe that'll work?

Peter Stockberger 16:34

I think it's possible. If if if I were defending a CCPA case and the lawsuit was brought alleging an unfair business practice claim, for example, under California law, citing the CCPA, citing the failure to adequately disclose the right to sale, I would file a motion to dismiss and cite that section of the CCPA that says there's no private right of action under the law, and it can't be used as a predicate for any other uh lawsuit. And that's that's important because the the UCL, the unfair competition law in California, historically you have been able to use other laws as predicates for that law, even if there's no private right of action. However, the CCPA carves itself out with that one provision. So I think that's gonna have to be tested in the courts, uh, but that won't stop creative plaintiffs' counsels from using that uh as a strategic move to expand CCPA lawsuits.

K 17:33

Interesting, but what about the federal one? Do you think it will preempt the federal unfair trade practices?

Peter Stockberger 17:40

Yeah, I think that's an it's an interesting question and would and probably would be one of preemption, whether the FTC Act preempts the CCPA. I don't think that it necessarily would because they're different subject matters, they're they're a bit different in scope. Uh but I think it's it's possible. Now the FTC Act would be brought by an FTC enforcement action, so it wouldn't necessarily be subject to state law, so I think you'd have different complications there. But the the the issue that you raise, though, by saying you don't sell data to comply with the CCPA, there's another risk there, even beyond litigation. And the other risk is the AG enforcement action. Because if you think about it, if you affirmatively state that you do not sell data, but there is a third-party contract that you have that you're exchanging data, and the third party is obtaining value in that exchange and is using that data for some other commercial purpose for themselves, and you haven't adequately carved it out as a service provider, and it in fact is a sale, but you just didn't know about it or you didn't pay attention to it and understand that it was a sale. Arguably, every transfer of a California resident's personal information in that transaction, from the moment you say you don't sell, is a violation of the CCPA because it's done without providing that individual the right to opt out. And the AG enforcement action is $2,500 per violation. So you could you could arguably see a scenario where every person's every transfer of data for each person is a separate violation, and there's no cap on penalties. So the risk of saying you don't sell without really running to ground and verifying each contract and the potential for sale, I think presents a significant risk, even putting aside the litigation.

K 19:33

Oh, absolutely. And and there's a couple of points there. I want to make sure that we don't we don't lose, but um I'm I'm writing one of them down to make sure I don't. But the other one, which I think is really fascinating when you talk about maybe you don't identify these uses in your company. For years, I I have been preaching, perhaps standing on my own little pedestal sometimes, that or my own soapbox maybe maybe a thing, is that your employees' ability to sign up for freeware or for cheapware that they can just expense when they turn in an expense report rather than it going through the procurement period, or the fact that maybe the cost doesn't hit the amount that is required to go through the contracting review period. Uh, in many companies, that's 10,000, 15,000, even if it's 5,000, it doesn't matter. A lot of these services may be $100 a year, or they may be free. The fact that your employees can sign up for this and you have no idea where data is being placed that your rogue employees may be signing up for is pretty worrisome. How does a company track that down other than policy and asking? I mean, I suppose e-discovery might be able to track some of the sharing of data, but what's your recommendations there?

Peter Stockberger 20:53

Well, I think at the outset, you're right, training and policy is important. For example, during the CCPA process, a number of clients that I counsel, we were providing training to folks that are in the marketing, in the business development departments, because they need to understand that signing up new agreements, bringing on new third-party vendors without running it through the privacy or legal department for risk analysis is tremendously risky under the CCPA. So that's that's the first step is to establish those workflows, establish an understanding within your departments as to the appropriate process before bringing on a third-party vendor. And the second problem you have is right now, if you're looking at your existing third-party vendor relationships and you've got, let's say, tens of thousands of contracts, how do you appropriately triage that and determine whether a sale is occurring? The best way to go about that at this point is you've got to identify categories. You've got to identify the high-risk categories of contractors. Who's receiving the biggest bulk of California resident personal information? And from there, if you are using a master services agreement, for example, or some sort of centralized document, uh, you can start there by making sure that the provisions don't implicate a sale and if necessary, provide some service provider protections. But otherwise, you do need to sort of dedicate a team and do enough due diligence that you're that you're in a position to say whether you do or you do not sell data. Now, a conservative approach would be if you don't know, but there's a possibility, then you can certainly provide the right to opt out to folks. Now, the problem with that approach is how do you track that and how do you effectively opt somebody out from a sale if you don't know whether a sale is occurring? So there's a number of Number of complications with the sale issue, but there's really no substitute for an aggressive due diligence on third-party contract relationships and establishing a clear workflow and third-party management system moving forward where your legal and your privacy team can appropriately judge the risk for each relationship and whether there needs to be some type of service provider addendum or contract provisions.

K 24:04

I love it. I love it. And there's a couple of questions I have there, but I'm trying to make sure that I focus on some of the really significant parts of the CCPA. Is there a recommendation you make to the individuals if they don't have sales as opposed to the sprink statement we don't sell personal data? Are you recommending any type of caveat language such as to the best of our knowledge, we have not identified any areas that we sell data?

Peter Stockberger 24:33

Well, a number of companies are making those type of qualified statements. I'm not I'm not sure that that's going to pass muster under the way the CCPA is framed. You know, the CCPA But it won't hurt. Yeah, it's it's unclear whether the AG is going to accept that as an appropriate statement. Right. Now, what's important is the AG regulations that are draft in draft form, they provide a lot of detail around this opt-out, the concept of sale. So it's very much in flux right now what needs to be disclosed and what doesn't. But bottom line is that it's it's a judgment call.

K 25:15

And Peter, let me ask you to repeat that last statement you just started, you cut out for about five seconds, and that was pretty meaningful. So I want to make sure we don't lose it.

Peter Stockberger 25:24

I think it started with this unclear whether or not the attorney general will accept that so if you put on your privacy policy or otherwise your notices that we may, to the best of our knowledge, we don't sell, or we may not, we we believe we don't sell information, some type of qualified statement. It's unclear whether the attorney general is going to accept that as an acceptable statement because the way the CCPA is written and the way the proposed regulations are written is that it's an affirmative statement as to whether you sell or not. The only area where the the CCPA gives you some wiggle room is on the sale of miners' data. Now there's a there's also a requirement where you have to say whether you sell the data of miners with or without their consent. And the proposed AG regulations say that you make that statement based on your knowledge. So they do give some qualification there, but not in others. Uh, not for the other uh statement on the sale. So that's what tells me that the AG is looking for affirmative statements.

K 26:29

Okay, I like it. I like it. So I'm gonna jump to a couple of topics. Uh, one, I'm gonna ask you before I get to specific topics: is there a particular area of the CCPA that um I would say your clients, but it doesn't have to be your clients, but business people are particularly worried about that we may not have touched on.

Peter Stockberger 26:48

I think one of the biggest operational issues with the CCPA for clients is the data mapping, data inventory process. Uh the the idea of But the CCPA doesn't require it doesn't per se, but it's it's almost impossible to comply with the law if you haven't done it. So it's it would be very difficult for a company to comply with a request for disclosure or request for deletion without knowing where that data sits and where it goes out and the third parties that may receive that data. Similarly, with the right to opt-out, you not only have to effectuate a right to opt-out request, but you also have to direct third parties who have received that data to also not sell. So if you don't have an adequate data map, data inventory showing all the points where you're taking in data, storing it, and where it's going out, it's gonna be difficult to have an effective complete response when these requests come in. So that's that's point number one. Point number two, if you don't have a full data map data inventory, even though the law doesn't require it, it's gonna be very difficult to say whether you sell data or not, because that data inventory is gonna tell you where the data is going out to third parties. I think the final area where data mapping data inventory is important is for the cybersecurity component. You know, the the law gives a private right of action in the case of a negligent data breach, where the business fails to maintain reasonable security procedures around the personal information it has. Well, it would be it's difficult to determine whether you have reasonable security procedures if you haven't identified all the points of California personal information you have and where it's stored and how it's being secured. So I think practically that data inventory, data mapping process is a must. That and that that's been posing a major operational challenge and it's a big spend sometimes for companies to undertake it. But I think practically it's right, it's something that needs to get done.

K 28:51

Oh, absolutely. And it's funny how I hear that companies pretty much have every excuse in the world to not want to do a data inventory, but yet we all agree it is a foundational element of a program. So with that, I'm gonna turn it back over to Paul. But first, thank you, Peter. Thank you so very much for your expertise and your wisdom and coming on our episode to share that expertise and wisdom with that. And so, Paul, what have you heard Peter and I discuss that stood out to you, or what questions do you still have about the CCPA?

Paul 29:27

For me, the most surprising point, and I wasn't actually aware of that, is the backdoor introduction of purpose limitation in the CCPA in these Attorney General guidelines that have been introduced and that you discussed with Peter. Basically, if you don't provide proper notice to individuals on how you are using their data and why you are collecting it in the first place, you will actually you're actually going to be in breach of some sort of purpose limitation principle, even though that is not made explicit in the CCPA text. Did I understand that correctly?

K 30:02

Oh, absolutely. That's one of the things about the CCPA I love is the Attorney General has stated that even though enforcement may not start before July 1st, he fully intends to go all the way back to January 1st in his enforcement, as Peter was saying as well. And I think one of the more fascinating things is just as we were talking about, if you didn't disclose the purposes for which you were collecting data as of January 1st, then you cannot use that data for those purposes if you didn't disclose it, even though enforcement doesn't start till July 1st at the earliest.

Paul 30:42

So that's not only ensuring that there is purpose limitation in place, it also to in in some way or form uh introduces the regulation of collection of data, which to the best of my understanding in most US legislation is only limited to the use of data. So that is that is completely new to me. I think it's great. I mean, I'm European, so I would always advocate EU-style legislation, even though I cannot enforce it in the US, unfortunately. But yeah, I think putting a limit on for which reasons data can be collected and make sure that that is legal and transparent, that organizations are honest about what they are going to do with your data is a big win. Do you think it's it's proper that the Attorney General would introduce something like this in his guidelines instead of the legislator in the text of the CCPA itself?

K 31:36

I actually do. The CCPA has an explicit provision that if you're going to use data for an additional purpose, you have to have a mechanism to go back and get permission from the individual. So it is actually in the text of the CCPA.

Paul 31:52

So it's a bit similar to the requirement to have data inventory and processing register in place without that being spelled out. But without one, it is very hard to comply with all the requirements to provide access to categories of data and categories of transfers and things like that.

K 32:09

Oh, absolutely. Having a data inventory is a fundamental part of any privacy program. How are you ever going to identify where your data comes in, where it's shared through the company and outside the company, if that sharing outside the company qualifies as a disclosure to a service provider under the CCPA or qualifies as a sale, as that term is broadly defined in the CCPA? I wish more laws actually required a data inventory, very similar to how the GDPR requires records of data processing, but unfortunately they don't. But it is an implicit requirement of any privacy program, as we as privacy professionals all know you really need that to be successful.

Paul 32:55

Yeah, absolutely true. Absolutely true. And um, yeah, I mean, I'm used to having everything spelled out in the law for me. That's the kind of lawyer I am and that I like to be. But it is actually pretty nice that you are able to provide this elaboration further explanation, but also imposing additional requirements basically via the uh the implementing guidelines. Right. Um so I would say, well done, Advocate General, Attorney General, not using the uh the EU terminology here. So one of the other things that that struck me in the conversation you had with with Peter is that there apparently is still discussion of what is a sale, what constitutes the sale of personal data.

K 33:40

Right. And it's it's interesting because there was a lot of conversation about how something like Google Analytics may qualify as a sale because companies would get free website analytics if Google was able to scrape up the data. Now, very few conversations were held about whether that actually was valuable consideration. I mean, I guess we could have argued about the term valuable. The data may have gone to a marketing company instead, which contracted those services to the company rather than the company directly. But it was interesting how quickly Google came out and changed a lot of its provisions for its analytics and its cookies.

Paul 34:23

Wow. Yeah, that is uh uh that is that is a big thing. And of course, selling data is is one of the cornerstones, or at least informing people that their data is being sold is one of the cornerstones of CCPA. Maybe, maybe one final point. We we don't need to to redo the full conversation you had with uh with Peter, but it also surprised me there is actually no cap on penalties.

K 34:46

I think it's fascinating that a regulator can impose the penalty that they think is appropriate. Our approach is a little different from the EU, which it seems that the EU regulators rarely impose the full extent of the penalty they're allowed, which is the 4%. Instead, they impose what they think is reasonable. Here in the US, or under the CCPA specifically, there is not a limit, but I like that the regulator can impose what they think is appropriate, but from a legal perspective, I don't like that there actually is no ceiling by law.

Paul 35:21

No, and that's that that was exactly the point I tried to get at. At least, I mean in the EU you also don't always know for sure what the what the fine could be because the limit is basically at 4%, and that could still be anything. But you are right, we we have to do what's reasonable, and that is not just because the regulators want to do that, but that is also because that is part of the GDPR as well. Any fine should be proportional in relation to the offense, which is basically uh your reasonableness criteria. Um but 4% is still could still be a very high fine in the millions and millions and millions of uh of euro category without knowing in advance how high that threshold will be. Only then that it will never be more than the uh the 4%.

K 36:10

From a practical level, we do have limits because if it is disproportionate, then that can always be appealed on its own.

Paul 36:18

True. So the courts will always have their their say there as well. I'm curious when we will um when we will see the first fines from California, and of course to see further fines here in in Europe. They have been announced, but uh we're hate we're waiting to uh to hear the amounts. But yeah, CCPA, are we done now once these guidelines are finalized? Can we finally start talking about something else again?

K 36:42

No, of course not. One, there is already class action litigation pending under the CCPA, so that will be something to watch. And two, Alistair McTaggart has already published Privacy 2.0.

Paul 36:57

Okay, so that is the ballot initiative you will vote upon come November 4th, right?

K 37:03

Yes.

Paul 37:04

Okay. Well, we'll talk about that when we get closer to November. Maybe we can get McTaggart on to actually discuss it with us and tell us what his plans are also after this second ballot initiative. Will there be a third one, a fourth one, a fifth one? What is the end of the story?

K 37:20

Oh, I love that.

Paul 37:21

For now, let's wrap up this episode. Thanks to all our listeners for joining another serious privacy discussion. We look forward to having you back in one of the future episodes. Just remember you can subscribe to Serious Privacy uh via Apple Podcasts, via Spotify, or any other podcast app that you like. If you have any questions for us or suggestions for topics or guests that we should speak to, feel free to reach out to SeriousPrivacy at TrustStark.com. And if you have any questions to K or myself, feel free to tweet us at uh podcastprivacy or at our personal accounts at Europol B for me.

K 38:01

And K is on Heart of Privacy on both Instagram and Twitter.

Paul 38:06

Thanks for listening, and we look forward to speaking again soon.

K 38:10

Thanks, Paul. Bye, y'all.