California Opts In

Modeled on European law, pending bill would require written permission for transfer of personal data

California could become the first state to adopt European-style personal privacy legislation if a committee of state legislators can blend two slightly different versions of the same measure into a single bill.

The Privacy Protection Act (SB-129), sponsored by state Sen. Steve Peace, was sent to a conference committee in late August after the California Assembly made several minor changes to the wording of the bill approved in May by the state Senate. Among other things, it contains an opt-in provision opposed by various industry groups, including the Direct Marketing Association.

The bill is based on the European Union’s directive on data protection. If it becomes law, companies would have to have an individual’s permission “to maintain a file on their financial transactions and they would not be allowed to share that information except under conditions approved by the individual,” says Peace.

“The objective is to do something globally so we don’t have to keep plugging privacy holes, industry by industry,” he adds. “Commercial interests are overwhelming any practical right of privacy in California.”

Gov. Gray Davis would not comment on the legislation nor indicate if he would sign such a measure into law.

As the bill now reads, information gatherers would be prohibited from providing personal information about their customers to third parties without an individual’s written authorization. Covered by that rule would be list companies, direct marketers, banks and other financial services institutions.

The measure would also create a privacy ombudsman in the state consumer affairs department to serve as a “non-binding arbiter of disputes” between individuals and information gatherers about unauthorized personal information disclosures. And it would authorize individuals to file civil suits against companies and individuals who disclose personal information about them without permission.

The Direct Marketing Association, which generally agrees with other provisions in the bill, “remains committed to the position that people should have the opportunity to opt out instead of opting in as required by the European Union’s privacy directive,” says Jerry Cerasale, senior vice president for government affairs.

That directive, in effect since last October, prohibits European companies from exchanging or providing information about individuals without their written consent, and with any company in any country that does not meet or subscribe to its privacy code.

But the EU, aware of its policy conflict with U.S. law and tradition, is allowing the free flow of European information to the United States while the U.S. Commerce Department seeks to negotiate a permanent agreement on data transfers. Although no formal agreement has been reached, negotiators for both sides report they are making progress.

However, British data suppliers have told clients that they are prohibited by law from shipping data to American data processors (DIRECT, October).

The DMA believes that the adoption of any European type of privacy legislation “would put the brakes on the U.S. economy,” causing significant harm to direct marketing and electronic commerce, Cerasale says. “The American economy has been growing rapidly, in part because it is an open information society,” he adds.

Cerasale and others are also concerned over unconfirmed reports that a privacy-related ballot initiative is being discussed in California.

Also working to get Peace’s bill changed is the Associated Credit Bureaus, the credit reporting industry’s trade association. “We think opt out can be the right choice and clearly would say that the EU’s approach is far too penetrating, too restrictive and, I think, impinges on Europe’s economic growth,” says Stewart Pratt, the association’s senior vice president for government affairs.

Pratt, who says he would like to have seen public hearings on Peace’s bill, doubts that the measure as it currently stands will become law because California legislators are sharply divided over its precedent-shattering stance.

Marty Abrams, vice president of Experian, one of the three major credit reporting agencies, also doubts that the bill in its current form will be ratified. “Although I think there are folks in California who would like to enact the bill,” he says, “I don’t think it will happen because it’s a process in flux and it remains to be seen what kind of bill the conference committee will come up with.”

Privacy Journal publisher Robert Ellis Smith also doesn’t support the opt-in measure. Although he criticized direct marketers for not making it easier for people to opt out of having information about them provided to third parties, Smith says opting in is “more appropriate for personal medical and financial records, not for marketing purposes.” The industry tradition of opting out, he adds, “seems to be working adequately and should be retained.”

The U.S. House of Representatives has approved a $49.5 billion transportation appropriations bill containing new privacy protections for motorists, sharply conflicting with those of the Drivers Privacy Protection Act (DPPA).

The new privacy protections in the bill, effective as of June 1, 2000, require state motor vehicle officials to obtain the written permission of licensed drivers and registered motor vehicle owners before supplying information about them to third parties for marketing purposes.

States failing to comply with the existing DPPA lose federal aid if they do not give drivers the choice of opting out of having their names made available for direct marketing. The new proposal specifies that states will not lose federal transportation aid even if they don’t offer drivers a chance to opt out.

Industry officials have expressed misgivings about this new approach.

Richard A. Barton, the Direct Marketing Association’s senior vice president for congressional affairs, says the bill’s opt-in provision “makes motor vehicle lists virtually worthless for marketing purposes, as it basically overturns the DPPA.”

The measure, previously approved by the Senate (S-1143) but with slight differences, now goes to a conference committee to reconcile the two versions into one for ratification by both chambers.

Earlier this year, a federal appeals court set the stage for the U.S. Supreme Court to decide the constitutionality of the 5-year-old law by affirming a lower court judge’s declaration that it wrongly directs states to enforce federal policy and is therefore unconstitutional.