This post was also written by Joshua B. Marker.
California legislators have proposed revisions to the Shine the Light Act, which we first wrote about here. Under pending legislation, the Shine the Light Act would be renamed the “Right to Know Act of 2013,” with significantly expanded reach and requirements. If the proposed amendment passes, it would expose any company doing business with California consumers to new duties of information disclosure, and the potential for more class action litigation if a consumer alleges the company did not follow the complex law to the letter.
If passed, the Act would significantly change the manner in which California’s Shine the Light Act currently functions. First, it would apply to all businesses that retain and/or disclose a customer’s personal information, as opposed to only those businesses that have an “established business relationship.” Second, it would expand the categories of personal information that the business must disclose to include location, buying habits, and sexual orientation. Third, it would require the business to disclose what information has been given to any third party, and not just that which was used for telemarketing, mailings, and other direct marketing purposes. Finally, the bill as written would further the efforts of the plaintiffs’ class action bar to enforce the Act’s terms via class action lawsuits (seeking up to $3000 per violation). The bill specifically states that a violation of the Act would be “deemed to constitute an injury to a customer,” an attempt to defeat a major hurdle that similar class action lawsuits faced under the Shine the Light Act.
The retention of personal information for certain purposes is exempted from the proposed Act. These purposes include processing payments, providing customer service, verifying customer information, and addressing fraud, security or technical issues. Even with these exemptions, the Right to Know Act would represent a substantially more draconian set of rules than even the current Shine the Light Act. Every company that does business with California consumers must act now to have a firm understanding of what types of information the company is collecting and how that information is shared, or risk being unable to comply with California law.