California Consumer Privacy Act Research Articles

Big data and AI in employment: The dual challenge of workforce replacement and protecting customer privacy in biometric data usage

The integration of Artificial Intelligence (AI) and Big Data is ushering in profound transformations across various industries, with biometric data usage standing out due to its deep implications for workforce dynamics and customer privacy. This review article critically examines the dual challenges presented by AI-driven automation and the extensive use of biometric data analytics, focusing on the resultant job displacement and escalating privacy concerns. Biometric technologies such as facial recognition, fingerprint identification, and voice analysis are increasingly deployed across sectors including finance, healthcare, and retail. These technologies aim to enhance security measures, improve user experience, and optimize operational efficiencies. However, they also bring to light substantial ethical dilemmas, particularly concerning the privacy of individuals and the security of the data being collected. The pervasive collection and analysis of biometric data can lead to invasive surveillance and profiling, exacerbating risks to personal privacy. Moreover, the use of AI in automating tasks that were traditionally performed by human workers is leading to significant shifts in employment structures. While AI can increase efficiency and reduce costs, it also raises the specter of widespread job displacement. This potential for automation-driven unemployment is especially pronounced in sectors that heavily utilize routine, repetitive tasks, posing critical socio-economic challenges. This article also explores the regulatory and technological frameworks currently in place, and those that are needed to address these challenges. The effectiveness of existing data protection laws, such as the General Data Protection Regulation (GDPR) in the European Union, and the California Consumer Privacy Act (CCPA) in the United States, is assessed in the context of AI and biometric data. We discuss the role of policy in shaping the ethical use of AI and protecting workers, along with the technological safeguards that could be implemented to secure biometric data and ensure privacy. By synthesizing insights from recent research, case studies, and expert analyses, this article provides a comprehensive overview of how AI and Big Data are reshaping the landscape of work and privacy. It critically discusses the need for a balanced approach that harnesses the benefits of technological advancements while safeguarding individual rights and employment security.

A Bilingual Longitudinal Analysis of Privacy Policies Measuring the Impacts of the GDPR and the CCPA/CPRA

Privacy policies are the main mechanism for websites to describe their practices in collecting and processing visitors' personal data. Their format and content are subject to legal requirements that have changed due to recent new privacy regulations including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and California Privacy Rights Act (CPRA). Studying how privacy policies are adapted to such regulatory change can help identify shortcomings in implementing the law and inform future legislatory initiatives. Existing work in this area mostly studied effects of the GDPR on privacy policies or the "Do Not Sell My Personal Information" link mandated by the CCPA. Methodologically, insights were mainly drawn from English-language privacy policies using keyword-based analyses or machine learning classifiers. In this work, we address this research gap and conduct a bilingual study of privacy policies in English and German that investigates the effects of the GDPR and CCPA/CPRA on privacy policy content, using established methods from corpus linguistics that are language-independent and do not rely on keyword lists or classifiers that may date quickly. We find that, unlike for the GDPR, the CCPA's requirements were not yet widely implemented when it first became enforceable but only with its amendment, the CPRA. Before that, websites used more than 60 variants of the "Do Not Sell" link instead of the mandated wording and did not prominently reference individual rights granted by the CCPA/CPRA. While companies outside California and the US did adapt their disclosures to the CCPA/CPRA, this was limited to English-language policies and did not spill over to policies in German. For GDPR enforcement, we find websites to increasingly rely on legitimate interests to justify data collection, raising concerns whether individuals' interests in the privacy of their personal information are still sufficiently considered.

Two Steps Forward and One Step Back: The Right to Opt-out of Sale under CPRA

The California Privacy Rights Act (CPRA) was a ballot initiative that revised the California Consumer Privacy Act (CCPA). Although often framed as expanding and enhancing privacy rights, a close analysis of textual revisions---both changes from the earlier law and changes from earlier drafts of the CPRA guidelines---suggest that the reality might be more nuanced. In this work, we identify three textual revisions that have potential to negatively impact the right to opt-out of sale under CPRA and evaluate the effect of these textual revisions using (1) a large-scale longitudinal measurement study of 25,000 websites over twelve months and (2) an experimental user study with 775 participants recruited through Prolific. We find that all revisions negatively impacted the usability, scope, and visibility of the right to opt-out of sale. Our results provide the first comprehensive evaluation of the impact of CPRA on Internet privacy. They also emphasize the importance of continued evaluation of legal requirements as guidelines and case law evolve after a law goes into effect.

DATA PRIVACY LAWS AND COMPLIANCE: A COMPARATIVE REVIEW OF THE EU GDPR AND USA REGULATIONS

This Review provides an overview of the comparative review of data privacy laws and compliance, focusing on the European Union's General Data Protection Regulation (EU GDPR) and data protection regulations in the United States. The analysis explores key similarities and differences, emphasizing their implications for businesses and individuals. The EU GDPR, implemented in 2018, stands as a landmark regulation governing data protection and privacy for individuals within the European Union and the European Economic Area. In contrast, the United States lacks a comprehensive federal data privacy law. Instead, it relies on a patchwork of sector-specific laws and state regulations, such as the California Consumer Privacy Act (CCPA) and the Health Insurance Portability and Accountability Act (HIPAA). One major distinction lies in the overarching principles of these regulations. The EU GDPR adopts a comprehensive and rights-based approach, emphasizing individual rights to privacy, data portability, and the "right to be forgotten." In contrast, the U.S. system often focuses on specific industries or types of data, leading to a more fragmented regulatory landscape. Both regulatory frameworks incorporate principles of transparency, consent, and data breach notification. However, differences in enforcement mechanisms and penalties exist. The EU GDPR imposes significant fines for non-compliance, reaching up to 4% of a company's global annual revenue. In the U.S., penalties vary by state, and enforcement is often reactive, triggered by data breaches. Businesses operating globally must navigate these distinct regulatory landscapes, necessitating a nuanced approach to data privacy compliance. Multinational corporations must adhere to the more stringent requirements when handling EU citizens' data while also considering the diverse regulations within the U.S. This review underscores the ongoing evolution of data privacy laws worldwide and the critical importance for organizations to stay abreast of these developments. It emphasizes the need for a proactive and adaptive approach to data privacy compliance, taking into account the unique requirements and expectations of both the EU GDPR and U.S. regulations.
 Keywords: Data Privacy, Laws, Compliance, EU GDPR, Regulations.

Global data privacy laws: A critical review of technology's impact on user rights

In the rapidly evolving landscape of technology, the intersection with data privacy laws has become a focal point for scholars, policymakers, and practitioners alike. This paper provides a comprehensive and critical examination of the global data privacy laws in light of the profound impact of technology on user rights. As the digital era progresses, the balance between technological innovation and the protection of individual privacy rights has become increasingly complex. The analysis encompasses a wide range of global data privacy frameworks, including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other relevant regional legislations. The paper explores the challenges and opportunities presented by emerging technologies, such as artificial intelligence, machine learning, and big data analytics, in shaping the landscape of data protection. Furthermore, the study evaluates the effectiveness and enforcement mechanisms of existing data privacy laws in addressing the ethical implications of technology, particularly in the context of user consent, data breaches, and algorithmic decision-making. Special attention is given to the evolving nature of digital surveillance, biometric data processing, and the implications of cross-border data transfers. In order to foster a comprehensive understanding, the paper also reviews the evolving nature of user rights and consent in the digital age. It critically examines the adequacy of current legal frameworks in addressing the challenges posed by technology-driven intrusions into individual privacy, considering issues of transparency, accountability, and user empowerment. By providing a nuanced analysis of the interplay between global data privacy laws and technological advancements, this paper aims to contribute to the ongoing discourse on the need for adaptive and robust legal frameworks. It calls for a proactive approach to address the evolving landscape, advocating for a harmonized and globally inclusive regulatory environment that safeguards user rights without stifling technological innovation.

Integrating Machine Learning with Cryptography to Ensure Dynamic Data Security and Integrity

Abstract: Keeping user data secure is very important in the modern era, as there are growing concerns on data privacy across the world. With very strict laws in place such as General data Protection Regulation (GDPR) in Europe and California Consumer Privacy Act (CCPA) in California, it has become a necessity for businesses and government agencies across the world to secure data in use, irrespective of whether it is at rest or in transit. Also, secure data transfer is a mandatory requirement for organizations which handle confidential data. Data privacy breach and data leak can impact the organizational value and reduce customer loyalty. In this paper, various methods of securing data transfer using a combination of Cryptography and advanced Machine Learning techniques have been discussed. The high-level idea is that ML should complement the existing cryptography methods used in practice, to build a robust and impeccable secure platform making it almost impossible for intruders to get into the system.

Foreign experience of personal data protection in social networks

The article analyzes the protection of personal data based on foreign experience. Social networking has been identified as one of the most prominent cultural phenomena to emerge in the Web 2.0 era. They keep users connected and facilitate the exchange of information between them.
 The European Union has adopted a new personal data protection system called the General Data Protection Regulation (GDPR). Its main goals include providing individuals with tools to control their personal data, implementing modern standards for the protection of personal information, developing the digital space of the European Union to safeguard personal data, ensuring strict compliance by all parties, and providing legal support for the international transfer of personal information.
 United States legislative documents related to aspects of data protection and privacy were analyzed, namely: California Consumer Privacy Act (CCPA); Children’s Online Privacy Protection Act (COPPA); Health Insurance Portability and Accountability Act (HIPAA); State data breach notification laws.
 It is noted that China has a comprehensive legal framework that regulates the protection of personal data, and includes the following legal acts: Personal Information Protection Law (PIPL) and Data Security Law (DSL).
 Conclusions were made that the urgency and importance of protecting personal data in social networks is due to rapid technological progress, the growth of cyber security threats and the spread of these platforms. By protecting personal data, people can maintain privacy, prevent abuse, maintain user trust, reduce risk, and comply with legal obligations. The issue of ensuring mobility and interoperability in social networks gives particular importance to the protection of personal data, as it relates to this particular data, and not just to technology, as it may be in the telecommunications sector. This requires additional thought and measures to ensure privacy and data security. Therefore, when developing legal protection mechanisms for online social networks, it is necessary to take into account and solve problems related to the protection of personal data.

Access Control Management System for Edge Computing Environment Using Tag‐Based Matching and Cache Injection

With increasing attention to the secondary use of data, privacy protection laws such as the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) have come into force to protect residents from unauthorized exploitation of personal data. Flow management is an effective method to track the distribution of user data in a multi‐domain network environment. Transparency in the relationship between data and service providers is essential to track the status of data provision. Vendor and Consumer Relationship Management (VCRM) manages this relationship by regulating relevant flow information. VCRM is expected to collaborate with the edge‐computing environment in the management of regional unit flow, wherein all access to personal user data should be restricted in accordance with the stakeholders' requests. Accordingly, this study proposes a packet processing function that collaborates with VCRM to manage the access control of flows passing through a regional network. Moreover, this paper proposes methods to reduce packet processing time on the switch, and requests to the switch controller. Using tag‐based matching and cache injection methods, the number of requests to the controller decreased to 33.4% of the original figure. Our proposed method also reduces the total processing time on flow management switches in the network environment in the analysis of encrypted TCP streams such as HTTP over TLS and MQTT over TLS. © 2023 Institute of Electrical Engineer of Japan and Wiley Periodicals LLC.

Lessons in VCR Repair: Compliance of Android App Developers with the California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) provides California residents with a range of enhanced privacy protections and rights. Our research investigated the extent to which Android app developers comply with the provisions of the CCPA that require them to provide consumers with accurate privacy notices and respond to "verifiable consumer requests" (VCRs) by disclosing personal information that they have collected, used, or shared about consumers for a business or commercial purpose. We compared the actual network traffic of 109 apps that we believe must comply with the CCPA to the data that apps state they collect in their privacy policies and the data contained in responses to "right to know" requests that we submitted to the app's developers. Of the 69 app developers who substantively replied to our requests, all but one provided specific pieces of personal data (as opposed to only categorical information). However, a significant percentage of apps collected information that was not disclosed, including identifiers (55 apps, 80%), geolocation data (21 apps, 30%), and sensory data (18 apps, 26%) among other categories. We discuss improvements to the CCPA that could help app developers comply with "right to know" requests and other related regulations.

Enabling Efficient Personally Identifiable Information Detection with Automatic Consent Discovery

Personal data leakage prevention has now become a critical issue for implementing data management and sharing in many industries. Several data privacy regulations such as General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPPA), California Consumer Privacy Act (CCPA), and Thailand's Personal Data Protection Act (PDPA) have been issued to enforce organizations to collect, process, and transfer personally identifiable information (PII) securely. In this paper, we propose a design and development of PII RapidDiscover, an efficient Thai and English PII discovery system featured with automatic consent discovery. At the core of our proposed system, we introduce the PII scanning algorithm based on the Presidio library and a natural language processing (NLP) technique to improve the scan result of PII written in Thai and English. Finally, we conducted the experiments to demonstrate the efficiency of our proposed system.

Breaking the Chains of Health Data

Breaking the Chains of Health Data

Privacy Legislation as Business Risks: How GDPR and CCPA are Represented in Technology Companies' Investment Risk Disclosures

Power exercised by large technology companies has led to concerns over privacy and data protection, evidenced by the passage of legislation including the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). While much privacy research has focused on how users perceive privacy and interact with companies, we focus on how privacy legislation is discussed among a different set of relationships-those between companies and investors. This paper investigates how companies translate the GDPR and CCPA into business risks in documents created for investors. We conduct a qualitative document analysis of annual regulatory filings (Form 10-K) from nine major technology companies. We outline five ways that technology companies consider GDPR and CCPA as business risks, describing both direct and indirect ways that the legislation may affect their businesses. We highlight how these findings are relevant for the broader CSCW and privacy research communities in research, design, and practice. Creating meaningful privacy changes within existing institutional structures requires some understanding of the dynamics of these companies' decision-making processes and the role of capital.

Does consumer privacy act influence firm performance in the retail industry? Evidence from a US state-level law change

In recent years, US states have introduced or passed consumer privacy laws. We explore the passage (June 28, 2018) and enforcement (January 1, 2020) of the California Consumer Privacy Act (CCPA) to ask whether such laws influence firm valuation. Based on organizational complexity and intangibility frameworks in the marketing literature, the law’s passage on June28,2018 did not have a meaningful stock market reaction in a sample of retail firms. Firms with higher intangibility or those with higher complexity and intangibility realized positive cumulative abnormal returns and Buy-and-Hold Abnormal Returns (BHAR). The findings are consistent after controlling for the text-based measures of privacy agreements, alternative measures of intangibility, and other robustness checks. Using the January 1, 2020, enforcement date, there were no meaningful changes in bounce rates and traffic from desktops or mobiles. The findings carry implications for policy makers, practitioners, and consumers.

A comparative analysis between General Data Protection Regulations and California Consumer Privacy Act

Data breach is a common phenomenon is these days. Entities holding the personal data are involved in providing data to marketing and other companies for their benefit. Consequently, the citizens suffer and pay the price of breaching. Various countries have adopted personal data protection laws in line with General Data Protection Regulations (GDPR). The California State has also made legislation to secure consumer rights in respect of personal data. This study made a comparison between General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA). After study, it has been identified that GDPR is a comprehensive document which can be used for providing security of personal data around the world. It has all the relevant clauses/ Articles that can be used accordingly. Furthermore, being dynamic in nature it has the capability to become adoptable to new changes/ technologies. However, there is a need to expend the scope of the study and conduct a comparative analysis on the basis of geographical boundaries. The future directions may include the study of laws relating to personal data protection of various developing countries in the context of the GDPR.

Brazilian General Data Protection Law (LGPD) and California Consumer Privacy Act (CCPA)

The issue of this work focuses on the critical analysis of the relevance of consumer personal data protection in the information society. The objective is to explain the relevance of the topic in light of the Brazilian General Data Protection Law and the California Consumer Privacy Act in the United States, in a micro-comparative approach. The literature review method was used, based on the theoretical-scientific construction through a comparison of the Brazilian and Californian legislation. To better understand the importance of protecting personal data today, the article discusses the global context of the knowledge society, the changes it has brought about in consumer relations, and then analyzes the Brazilian General Data Protection Law and the California Consumer Privacy Act. After studying both laws, it concludes that, considering the experience of the State of California and the growth of e-commerce in the country, it is up to Brazil to regulate the matter of protecting the consumer's personal data.

Citizens’ Data Privacy in China: The State of the Art of the Personal Information Protection Law (PIPL)

The Personal Information Protection Law (PIPL) was launched on 1 November 2021 in China. This article provides a state-of-the-art review of PIPL through a policy analysis. This paper aims to compare the three main worldwide data privacy paradigms that exist at present: (i) the General Data Protection Regulation (GDPR) in the E.U., (ii) the California Consumer Privacy Act (CCPA) in the U.S., and (iii) PIPL in China. The research question is twofold: (i) how will PIPL affect the data privacy of Chinese citizens and consequently, (ii) how will PIPL influence the global digital order, particularly paralleling the existing GDPR and CCPA? In the first section, this article introduces the topic of data privacy as a global concern, followed in the second section by an in-depth policy context analysis of PIPL and a literature review on privacy that elucidates in particular the impact of the Social Credit System (SCS). In the third section, a comparative benchmarking is carried out between the GDPR, CCPA, and PIPL. Methodologically, policy documents around PIPL will be analyzed. In the fourth section, the case study of Shenzhen will be examined by undertaking a multi-stakeholder analysis following the Penta Helix framework. The article concludes by responding to the research questions, acknowledging limitations, and presenting future research avenues.

IT and the many challenges for nonprofits

Security is a concern for companies in any industry. While it is often discussed in the context of governments and private‐sector organizations, nonprofits need to be just as vigilant when it comes to understanding the need for data privacy and implementing solutions to keep critical information safe. Informed donors, as well as government and regulatory agencies, are keenly interested in data security issues, such as personally identifiable information and hardened systems. Penalties for data breaches can be severe both in monetary costs as well as in reputational damage. Furthermore, privacy laws, such as the California Consumer Privacy Act (CCPA), can have an impact on nonprofits. That's because, although nonprofit organizations in California are exempt from the CCPA, they must take due care of their own vendors and providers. Through their actions, they must demonstrate that they are following the law. The fact is that consumers, in general, do expect their private data to be protected by the “steward of the data.” If that steward is the nonprofit, then that is where the perceived and implied obligation to protect data may lie.

Setting the Bar Low: Are Websites Complying With the Minimum Requirements of the CCPA?

Abstract On June 28, 2018, the California State Legislature passed the California Consumer Privacy Act (CCPA), arguably the most comprehensive piece of online privacy legislation in the United States. Online services covered by the CCPA are required to provide a hyperlink on their homepage with the text “Do Not Sell My Personal Information” (DNSMPI). The CCPA went into effect on January 1, 2020, a date that was chosen to give data collectors time to study the new law and bring themselves into compliance. In this study, we begin the process of investigating whether websites are complying with the CCPA by focusing on DNSMPI links. Using longitudinal data crawled from the top 1M websites in the Tranco ranking, we examine which websites are including DNSMPI links, whether the websites without DNSMPI links are out of compliance with the law, whether websites are using geofences to dynamically hide DNSMPI links from non-Californians, how DNSMPI adoption has changed over time, and how websites are choosing to present DNSMPI links (e.g., in terms of font size, color, and placement). We argue that the answers to these questions are critical for spurring enforcement actions under the law, and helping to shape future privacy laws and regulations, e.g., rule making that will soon commence around the successor to the CCPA, known as the CPRA.

The Brussels Effect: How the GDPR Conquered Silicon Valley

In 2018, the Californian government adopted a new data protection framework. The flagship of this framework is the California Consumer Privacy Act (CCPA). As this new framework is widely considered to resemble the European Union’s (EU’s) General Data Protection Regulation (GDPR), this article intends to investigate whether the Brussels Effect could explain this resemblance. We apply process-tracing to test if the Brussels Effect causally connects the GDPR with the CCPA. The analysis is based on a careful evaluation of three sets of evidence. Firstly, privacy policies of Apple, Facebook, and Google are examined. Secondly, lobbying concerning the alignment of the implementation of the CCPA with the GDPR is scrutinized. Lastly, it is investigated whether the Californian government has used arguments linked to the Brussels Effect while drafting the CCPA and its subsequent implementing regulations. It is concluded that the Brussels Effect has indeed played a role in the adoption of the CCPA. Nevertheless, it has become clear that the impact of the Effect varies depending on exactly which provision of the GDPR is examined. Brussels Effect, process-tracing, California, CCPA, European Union, GDPR, Data Protection, Lobbying, Big Tech

Data protection regulation: a comparative law approach

This paper aims to present a comparative approach to data protection regulations around the world. Most countries possess data protection laws in some level of detail. In order to compare structures of data control and compliance in dissimilar systems, the study selected four distinct arrangements : the European General Data Protection Regulation (GDPR); the California Consumer Privacy Act (CCPA); the Brazilian Digital Privacy Law, Lei Geral de Proteção de Dados Pessoais (LGPD); and the Chinese Data Privacy Framework, which is molded by a set of different regulations. The analysis was based in common key points of those regulations – territorial scope, consent and disclosure, data security requirements, data transfer, Data Protection Officer, awareness and training, and penalties – to explore the different policies and national goals. The paper argues that, in the landscape of the information based society, new law is needed to protect citizens’ rights to privacy and to bound harvesting and mining of personal information to ensure transparency, control, and compliance of the information economy.