Very few companies are going to want to maintain a separate GDPR strategy, a separate CCPA strategy, and an unregulated strategy, and then selectively apply each to various users. As more jurisdictions jump on board with privacy requirements, hopefully globally consumers will get the benefits of the strongest passed regulation in each category.
I agree that a regulatory agency specialized to these issues would increase their importance, but it's not the whole solution. ICO already existed, it just didn't have teeth.
It likely won’t start until July 2020, and it’s hard to imagine the state AG prioritizing this except for cases you mention - very high profile/political.
Current estimates are that out of roughly 500,000 businesses in scope, only 2% will be in compliance by January 1st. Though to be fair, GDPR numbers were fairly similar at the onset.
Regardless of my skepticism, I can’t help but feel this is better than nothing, and likely better than an even more diluted federal regulation that all the big corps are lobbying for.
It remains to be seen how many companies comply, but the law certainly does have some restrictions.
Furthermore, there is a CCPAv2 in progress for a proposition on the next ballot.
But am I really supposed to fill out a DNSMPI form every time I interact with any business? How many new businesses do you think you interact with on a given day? I suspect it is a lot.
Opting out is an unreasonable burden and there's a reason why almost no one does it. And yet we know consumers want privacy, so there is clearly a larger structural problem here.
We already know the solution! Make data collection opt-in.
Also, the "legitimate interest" of the business is required to be weighed against the interests of the data subject, so it isn't a blank check.
As an European I don't feel like it's opt-in.
Last I've heard Google is still tracking me left and right.
I think most startup people would have no problem with the GDPR if it included the minimum limits that the CCPA has.
CCPA does not restrict the collection or processing of personal data for marketing purposes. You can't even opt-out. Companies like BounceX will still be able to deanonymize 40% of consumer web visitors for direct marketing. You can only opt-out from your data being sold. And how are you supposed to know when a company is selling your data? The company is not required to tell you – you have to ask.
GDPR the other hand is entirely opt-in. Companies cannot collect or process personal information unless given explicit consent. And that's a big deal – the rate of consent is so low that many marketing projects have a negative ROI and companies stop working on them.
Enforcement will likely be weak. CCPA introduces civil penalties so consumers can sue companies, or join class action suits, but it will be difficult for a consumer to know when a business is violating CCPA, so this will be rare. California's AG can bring action, but there isn't a very strong incentive for them to do so with the exception of high-profile, politicized cases.