Alastair Mactaggart, San Francisco real estate developer. Photo Illustration: Jason Doiy/ALM

Alastair Mactaggart, the driving force behind the California Consumer Privacy Act, is back with a new data-protection measure he hopes to place on the 2020 ballot.

The original California Consumer Privacy Act won't take effect until Jan. 1. It won't even be enforced until July. But Mactaggart, a San Francisco real estate developer turned consumer privacy champion, says the time is right for another measure that will place more data-gathering restrictions on companies and create a state privacy enforcement agency. And don't expect him to drop his initiative like he did in 2018 in favor of legislative action.

Mactaggart recently spoke with The Recorder about what's in his new ballot measure and why he wants to go directly to voters instead of state lawmakers. Here are excerpts from the interview, edited for length and clarity.

The Recorder: Why forego the legislative process? It seems to have worked pretty well for you over the last year.

Mactaggart: We really spent this whole year working with other advocates to ensure the CCPA was not gutted and weakened and essentially thrown out. That, I think, was a big victory in terms of the amount of effort that was put against us. What's become apparent to me is that that dynamic is never going to change. Businesses will just keep on coming back.

I personally think these are new human rights. And I think that these new human rights are so important that they deserve a little extra protection.

Because I am a believer in the process, and I believe this is a complicated area where inevitably we will want to make changes, I'm saying in this [initiative] the Legislature will have the right to amend it by simple majority. Not even a supermajority. But any amendment has to be in furtherance of the act. And sure, there may be disagreement over what that means, but I think the jurisprudence is pretty clear that that does not mean "we're going to exempt an entire industry" or "and we're going to gut the law."

Who helped you write this initiative?

A person that's been consulting with me for basically the last two years is a fellow named Ashkan Soltani, who was the former chief technologist at the [Federal Trade Commission]. And he is an interesting guy because he's got a whole network of people in privacy who are true experts and they don't work for tech.

And then I reached out to people to take their temperature on various things. Because I'm not trying to play gotcha here. I'm not trying to create something that doesn't work. I'm acutely aware as a business person that the best regulations are simple regulations, the ones that businesses can understand.

And then obviously, my lawyer, James Harrison [of political law firm Remcho Johansen & Purcell].

The new initiative creates the California Privacy Protection Agency, which would assume some of the privacy duties now handled by the Attorney General's Office. How big do you think this agency would be? You've said it may employ 25 attorneys.

I think that's where it starts off. Look, we're the fifth-largest economy in the world. And everybody says, "Oh, privacy." This is not really privacy. What it really is is regulating some of these basic activities that these largest corporations in the world have grown. It's an important area to regulate and get it right because you don't want to cut off innovation, you don't want to cut off wonderful technology that is so great in so many areas.

The new initiative would allow privacy audits of businesses. I've got to imagine that would cause some angst in the business world. How do you see that working?

It's kind of trust and check. I'm a business person in California. The [Franchise Tax Board] has audit authority. Do I think that's a good idea? Yeah. What's the point of having a tax authority if they can't audit?

This idea that we have regulations but nobody should be able to come look at what you're doing—I don't understand it. It's like, here's a law, follow it. And I've been audited by the FTB. So what? You put your documents together, you say, "here's what we did. Fine, thank you," and they go on their way. I think people who start objecting about audits are people who are not planning to comply with them.

There's a new focus in the initiative on "profiling" and tracking the geolocation of users. Why?

Profiling is really a concept drawn from other jurisdictions. We're saying if you're subject to the results of an algorithm that are automated, which could have an adverse effect on certain limited categories: the housing that you get, the job opportunities that you get, the denial of employment, a health condition, enrollment at an educational institution—these kind of critical areas in your life—then a company has to explain meaningfully, what's the algorithm? What does it do?

Geolocation is now part of sensitive information. I've got to tell you, of all things, the thing that makes people the most upset is this notion that just by having a phone or car, the fact that you went to the gym today and for how long you stayed there, or that you went to a fast food restaurant or that you're a certain religion or that you're in rehab or that you've gone to the reproductive health clinic, the fact that you went to an HIV clinic, is all for sale. People are incensed about that. And they want to stop it.

And then there's language about selling information for political use. What's that about?

This is one that I think is theoretical, and I hope it will always stay theoretical.

If you are a large social media company or a search company—and again, I want to emphasize that I don't think this is happening now—but if you wanted to change the outcome of an election, it is your First Amendment right as a corporation in this country to use your resources to advocate for election change. It's completely guaranteed.

You can imagine a fairly simple scenario where a company's like, "Oh, we just need to identify the swing voters, we're going to push them all one way or the other—stay home or go out to vote." All this [initiative] would say is, if you're doing that, company, guess what? There is disclosure required. I'm telling you, I think that's a time bomb waiting to go off in the heart of our democracy.

 

Read more:

Strategies for Minimizing Exposure to Potential CCPA Damages

How Changes to California's Data-Privacy Rules Would Affect Employers

A Prediction From Alastair Mactaggart: Privacy Law Will Survive Tech Challenge