California Businesses are Already Hurting, Prop 24 Will Rub Salt in the Wound
2020 cannot get much better, but it can get much worse. Small businesses across the country are feeling the pinch of COVID-19 that forced their customers to stay home. This made many businesses innovate to get the attention of customers through their only interaction with the outside world: the internet. While there are creative ways local businesses have innovated, Proposition 24 which was recently passed in California puts much of this at risk. Prop 24 builds upon the California Consumer Privacy Act (CCPA) and seeks to amend the law to make it harder for companies to use consumer data. While sounding like a victory for the consumer, it is a defeat for everyone.
The CCPA is a law that mandates how businesses use data Californians create. This includes personal data (such your online purchasing history) that businesses rely on to create targeted ads you see when you browse the web. The law allows Californians to know what data is collected, who it is being sold to, access to that data, and the right to request businesses delete their data or not sell it. Two of the major changes that Prop 24 makes is amending how the legislature interacts with the law and creates an enforcement agency to monitor business compliance. With such changes potentially coming, the economic costs to small business deserve more attention.
A Standardized Regulatory Impact Assessment (SRIA) prepared for the California Attorney General on the CCPA looked at how the law would impact businesses and consumers in the state when it is enforced. The SRIA stated that small businesses would be disproportionately impacted with further competitive disadvantages compared to larger firms and out-of-state businesses. The report offers a silver-lining, stating that the CCPA would incentivize innovation for companies to offer services that help firms maintain compliance, though this is speculative. Even with companies offering compliance services there has not been enough time to implement and enforce most of its provisions. This has not allowed small California businesses to fully analyze the effects of the law before it is potentially amended further this November, creating an environment that favors bigger tech companies.
The goal of the CCPA and Prop 24 is to protect consumers from “Big Tech” but unintendedly targets small businesses who struggle to afford the compliance costs. In fact, many of the “Big Tech” companies that were in mind when the law was written were already compliant with the CCPA. Large companies with European customers are already under a similar law called the General Data Protection Regulation (GDPR) passed by the European Union (pg. 31 SRIA). Companies compliant with GDPR are in a better position to change their operation and match the CCPA and are not confronted with the same money and legal constraints like small businesses. This creates a law that goes after “Big Tech” but actually hurts “Small Tech,” meaning small businesses will play catch-up in a time when the impacts of COVID on revenue are already squeezing them.
The CCPA is expected to cost $55 billion for companies to become compliant, with an additional minimum of $10 million of taxpayer money on top to establish the monitoring agency from Prop 24. What makes this situation worse is if Prop 24 is passed, efforts to amend the law if it is found to be too harmful will be hampered because the California legislature will have limited power over it.
One major concern is the legislature has only one direction to take future amendments of the law: forward. This limits the legislature to amend the law “provided that such amendments are consistent with and further the purpose and intent of this Act as set forth in Section 3.” What exactly “consistency” means depends on who you talk to, opening the law up to further harm small businesses that rely on consumer data. The easiest way the law may be contested is in the courts. This can be an effective method but removes the power of the legislature to legislate! Efforts to reform the law as it ages or if analysis finds that the law hurts more than helps California would be drawn out in battles across the legislature and courts instead of being fixed.
Prop 24 is not a smart piece of law to implement right now. Small businesses are already heavily impacted from the COVID pandemic, and many have not had time to see how their business will change with the CCPA. The CCPA was just implemented in January this year and became enforceable only three months ago, and there are already propositions on the ballot to change it and give it more teeth. Prop 24 is not the band-aid it is being sold as, but rather a pinch of salt being rubbed into a wound.
