Calif. Privacy Agency Provides 'More Time to Digest' Revised ADMT Draft
Comments are due June 2 on revised draft rules for the California Privacy Protection Agency’s rulemaking on automated decision-making technology (ADMT), risk assessments, cybersecurity, insurance and other rule changes, the CPPA decided Thursday.
Sign up for a free preview to unlock the rest of this article
The deadline exceeds a 15-day statutory minimum, said CPPA General Counsel Philip Laird. It provides about 30 days from the board meeting, though the agency won’t technically open the comment period until next week, he said. Under the board’s motion, approved by a 5-0 vote, staff will “further modify the text in line with today’s discussion” before releasing it for comment.
The CPPA released the revised draft Wednesday, and it included significant changes from the previous draft rules, such as exorcising the terms “artificial intelligence” and “behavioral advertising.” CPPA Chairperson Jennifer Urban supported giving stakeholders "more time to digest" the revisions. Earlier in the meeting, Urban raised concerns that staff had pared the draft rules “to the bone” in response to business concerns, possibly at the expense of consumer protection (see 2505010048).
As such, consumer advocates raised concerns about the latest draft in public comments during the meeting. “It seems the agency has moved to weaken important definitions, like the definition of automated decision technology, among other significant changes,” said Danielle Kando-Kaiser, lobbying for Consumer Reports and Electronic Frontier Foundation.
“We're deeply concerned that if the board continues with this extremely narrow definition of ADMTs, an employer could self-certify itself out of coverage by claiming that a given automated system does not substantially replace human decisions,” said Swati Chintala, TechEquity research manager-labor.
However, multiple business groups supported the latest round of changes. It’s a “step in the right direction,” particularly with the new ADMT definition and the removal of behavioral advertising, said Edwin Lombard, a lobbyist for California African-American Chamber of Commerce.
Also at the meeting, the CPPA board agreed to support four state privacy bills: AB-1355, which would restrict certain entities from collecting, using and selling location data (see 2504290064); SB-44 on neural data privacy; SB-361, which adds requirements to the California Delete Act (see 2504020055); and SB-470, which would extend some sunsetting rules that allow the agency to hold meetings by teleconference.
In addition, the board voted to take a “support if amended” position on SB-468, which would require deployers of high-risk AI systems that process personal information to implement comprehensive information security standards. The CPPA said it would like to have enforcement authority in addition to the rulemaking power that the bill currently would provide.