Overview
California Attorney General Kamala Harris announced yesterday that she is creating a Privacy Enforcement and Protection Unit in her office. The PEPU, which will consist of six prosecutors, will be responsible for prosecuting companies that violate the state’s privacy laws.
California, of course, has been at the vanguard of privacy protection, enacting the nation’s first data breach notification law, and requiring website and online service operators that collect personally identifiable information about consumers residing in California to "conspicuously post" their privacy policies and to provide certain minimum information in such policies (California Online Privacy Protection Act). It has also enacted, among other things, a "shine the light" law (SB 27), which requires companies that have more than 20 employees and that collect personal information from California consumers to provide consumers with a list of all of the third-party direct marketers to whom their personal information was disclosed in the previous calendar year; the "Consumer Protection Against Computer Spyware Act" (SB 1436), which prohibits several intentionally deceptive or misleading acts with respect to the unauthorized installation of software on a user's computer; and the Financial Privacy Information Act, which establishes standards for sharing nonpublic information with affiliated and non-affiliated entities. And, of course, California’s Constitution explicitly recognizes a right to privacy.
The state has also been increasingly aggressive in enforcement. In February, for example, the state AG reached an agreement with mobile platform providers including Google, Apple, Research in Motion, Amazon, Microsoft, and Hewlett-Packard, which commits the providers to ensuring that all mobile apps offer privacy policies that users can read before downloading. One of the PEPU’s first jobs will be to see whether the terms of this agreement are being met.
The Unit will reportedly focus much of its attention on mobile privacy issues generally, which a special assistant attorney general termed “the wild, wild West” in terms of privacy. While six prosecutors don’t exactly form a fearsome posse, it’s the precedent that matters most. Because when it comes to privacy, where California leads, other states soon follow.