Privacy regulators emphasized that the CPPA has not yet commenced the formal rulemaking process for cybersecurity audits, risk assessments or automated decision-making technology, also known as ADMT, and that the draft text of the proposed regulatory framework is intended to facilitate the agency's board discussions and is subject to change.
The draft regulations essentially outline how new privacy protections that Californians voted for three years ago could be implemented, the CPPA said Monday.
The CPPA plans to provide feedback on the proposed regulations at the next board meeting scheduled for Dec. 8, and the formal rulemaking process is expected to commence next year.
"Once again, California is taking the lead to support privacy-protective innovation in the use of emerging technologies, including those that leverage artificial intelligence," said Vinhcent Le, a member of the California Privacy Protection Agency's Board and the New Rules Subcommittee. "These draft regulations support the responsible use of automated decision making while providing appropriate guardrails with respect to privacy, including employees' and children's privacy."
The proposed framework includes drafted regulations that define new safeguards related to companies' use of ADMT in several ways, including decisions that could result in legal or similarly significant impacts concerning a consumer, profiling a consumer who is acting as an employee, job applicant, student or contractor, profiling an employee using keystroke loggers, productivity or attention monitors, video or audio recording or live-streaming, facial- or speech-recognition or-detection, automated emotion assessment, location trackers, speed trackers, and web-browsing, or social media monitoring tools.
Consumers would have a right to opt out of businesses' use of ADMT, and businesses must provide them with the ability to opt out of several uses of ADMT, according to the proposed framework.
Companies must also provide opt outs for profiling a consumer when they are in public areas such as shopping malls, or any place using Wi-Fi or Bluetooth tracking, and also allow them to opt out of radio frequency identification, drones, live-streaming, geofencing, location trackers or license-plate recognition, the CPPA said.
Opt outs must also be provided when profiling a consumer for behavioral or targeted advertising, which includes analyzing their personal preferences and interests to display certain advertisements, according to the CPPA's proposed rules.
The drafted regulations also propose possible options for additional consumer protection around the use of their personal information gleaned from ADMT. Proposed protections include requiring businesses to provide "pre-use notices" to explain how they intend to use the ADMT so that consumers can decide whether to proceed, opt out or access more information, the CPPA said.
Businesses using ADMT must also provide two or more designated ways for submitting opt-out requests, and a notification or tool regarding cookies like banners or controls themselves are not an acceptable method for submitting opt-out requests since these cookies concern the gathering of personal data and not necessarily the use of ADMT, according to the proposed rules.
The CPPA said the drafted regulations would work in conjunction with risk assessment rules that the board will also evaluate next month. Together, the proposed regulations and framework will provide Golden State consumers with more control over their personal data and how it'll be used while ensuring the ADMT, including those created from artificial intelligence, are utilized with privacy in mind and design, the CPPA said.
"Automated decision-making technologies and artificial intelligence have the potential to transform key aspects of our lives, said Ashkan Soltani, executive director of the CPPA. "We're proud that California is meeting the moment by giving consumers more control over these technologies."
--Editing by Vaqas Asghar.
For a reprint of this article, please contact reprints@law360.com.
