SACRAMENTO (CNN) — California residents could be getting even more rights when it comes to protecting their data.
State officials proposed a new amendment to the California Consumer Privacy Act (CCPA) on Monday that would allow consumers to sue companies that violate the new law. Currently, consumers can only file a lawsuit if they’re victims of a data breach and only when the state’s department of justice has decided not to sue on consumers’ behalf.
The CCPA, which was passed in 2018 and goes into effect in 2020, is the toughest privacy legislation in the United States. It’s also the first law in the country that gives people control over the use of their personal data.
Key parts of the law include prohibiting businesses from discriminating against consumers who exercise their rights and requiring businesses to disclose how they collect and share consumer data. It also lets consumers request that their data be deleted and makes it possible for people to opt out of the sale or sharing of their personal data.
The proposed amendment would give people more avenues to pursue their own resolution in court for any violation of the CCPA.
California Attorney General Xavier Becerra and State Senator Hannah-Beth Jackson unveiled the amendment at a press conference in Sacramento on Monday afternoon.
Consumers would be able to sue companies for misusing their data or suffering a data breach. The law would apply to tech companies like Facebook and Google as well as any other businesses that collect and handle personal information such as Marriott or Amazon. Facebook declined to comment. Google and Marriott did not respond to a request for comment.
James P. Steyer, CEO of Common Sense, a non-profit organization that promotes safe technology use, said the amendment will take some of the burden of enforcing and monitoring violations off the attorney general’s plate.
The amendment would also remove the current waiting period that gives businesses 30 days to attempt to remedy a violation and retract any exposed data from public view to avoid penalties.
Additionally, under the amendment companies would no longer be able to ask the state DOJ for “free” legal advice about complying with the privacy law — a benefit that was included in the original privacy law.
The amendment would instead allow the Attorney General’s office to publish general guidance for companies complying with CCPA that anyone could access.
This new amendment follows legislation proposed on Thursday that would require companies to notify California residents when their passport, passport card or green card numbers are compromised in data breaches. It would also require customers be notified of compromised biometric information such as fingerprints.
California is the first state to have legislation like the CCPA, but other states are using it as a potential framework for adopting their own privacy laws.
Congress is also considering a national law that would address consumers’ right to protect their data. While companies have lobbied for a law that would overrule the CCPA, state legislators have urged Congress not to nullify the consumer protections attained in the act.