The agency “will be under some political pressure,” said Tracy Rosenberg, executive director of the nonprofit Media Alliance, a Bay Area public interest group, which also works with Oakland Privacy. , a community group. “We don’t really know how the governor and the legislature are going to react if there is a pushback because of the actions taken by the agency.”
Supporters of the agency said its independence was partly protected by its structure, with unpaid board members appointed separately by different elected officials. Mr Soltani described the initial funding as “like putting in a game of poker” because voters “bought in” for at least $10 million, but said the Legislative Assembly could give more.
The agency’s first task will be to transform the state’s broad privacy law into detailed regulations for the industry. This runs the gamut, from how data is used for targeted ads to newer areas of law, like how algorithms use personal information to make automated decisions. The law also requires companies to respect the privacy preferences that online users set in their browsers; it is up to the agency to decide what this means in practice.
Eventually, the agency will have the ability to enforce its rules. Companies may also be required to submit audits of their cybersecurity risk to the agency. He asked for comments on what, exactly, these audits should include.
The agency asked the public, nonprofits and businesses to submit comments to guide its initial rules. Privacy activists and industry groups filed hundreds of pages of comments, trying to influence agency decisions. Google, for example, has asked the regulator to write rules that provide “the flexibility for businesses to respond to consumer demands in a way that prioritizes substance over form” and to align with laws on confidentiality in other states.
A Google spokesperson, Jose Castaneda, said in a statement that the company advocates nationwide privacy legislation and that “As the California Privacy Agency continues its work, we will continue to engage constructively to ensure the privacy of our users”.
The Privacy Agency’s board announced in February that it would hold workshops, likely this month, for more input from privacy experts and academics. At a meeting that month, Soltani said the group would likely release its first regulations later in the year so it could balance hiring staff with the complex questions it had to answer.
“We build the car while we drive it,” he said.