The agency “will be subject to some degree of political pressure,” said Tracy Rosenberg, the executive director of the nonprofit Media Alliance, a Bay Area public advocacy group that also partners with Oakland Privacy, a community group. “We don’t really know how the governor and the legislature will react if there is a backlash because of actions the agency is taking.”
The agency’s proponents said its independence was protected in part by its structure, with unpaid board members appointed separately by various elected officials. Mr Soltani described the initial funding as “like the ante in a poker game” as voters “bought in” for at least $10 million, but said lawmakers could give more.
The agency’s first task will be to translate the state privacy law, which is broad, into detailed regulations for the industry. That covers the whole range from how data is used for targeted advertising to more new areas of law, such as how algorithms use personal information to make automated decisions. The law also requires companies to adhere to the privacy preferences that online users set in their browsers; it is up to the agency to determine what that means in practice.
Ultimately, the agency will have the ability to enforce its rules. Companies may also be required to submit audits of their cybersecurity risk to the agency. She asked for input on what exactly those audits should entail.
The agency has asked the public, nonprofits, and businesses to submit comments to guide the original rules. Privacy activists and industry groups have submitted hundreds of pages of comments to influence the agency’s decisions. For example, Google has asked the regulator to write rules that “give companies flexibility to respond to consumer requests in a way that prioritizes content over form” and to comply with privacy laws in other states.
A Google spokesperson, Jose Castaneda, said in a statement that the company was advocating for national privacy laws and that “as the California Privacy Protection Agency continues its work, we will continue to work constructively together to ensure that we protect the privacy of our users.”
The Privacy Protection Agency board announced in February that it would hold workshops, likely this month, for more commentary from privacy experts and academics. At a meeting that month, Mr. Soltani said the group is likely to issue its first rules later in the year so it can strike a balance between hiring and the complex questions it must answer.
“We build the car as we drive it,” he said.
