California’s battle over data privacy and algorithm protections reaches a crossroads

Let’s say you work in the food service industry for a large company, whose scheduling software assigns shifts to workers. For you, which shifts you receive mean everything because much of your salary depends on tips. But in the eyes of the algorithm, you could be deprioritized and miss out on lucrative weekend shifts based on mysterious data. Without your knowledge, information such as when you take a break, how fast you turned over a table or where you live could work against you. 

Shouldn’t you have the right to know the logic behind the algorithm, and the right to opt out of its automated decision?

Californians were on track to have novel protections against automated decisions under rules drafted by California’s top privacy agency, the California Privacy Protection Agency. But this month, the privacy board proposed substantially narrower privacy regulations, including deleting specific protections — like the example above — surrounding criminal justice, education, essential goods like food, and employment matters if they were made by automated decisions. 

Some members even suggested deleting the automated decision-making language altogether. The five-member board also committed to deleting other rules aimed at giving people control of their personal information in the training of artificial intelligence and in targeted advertising. 

We are at a major crossroads in California’s battle over data privacy protections. After the establishment of the landmark California Consumer Privacy Act and its 2020 voter-enacted California Privacy Rights Act, forces within the privacy agency and Gov. Gavin Newsom, under pressure from powerful business interests, are pushing to scale back these seminal protections. A key hearing is scheduled for Thursday.

After the departure of the protection agency’s first leader, Ashkan Soltani, and the very questionable dismissal of privacy-facing board member Vinhcent Le, there has been a shift away from the pro-consumer mission statement of the small but influential agency. The new head of the agency is Tom Kemp, a tech entrepreneur. The real estate developer who spurred the state’s data privacy law is now among some of its biggest skeptics.

But wouldn’t you want to know if algorithms, not people, were deciding sensitive aspects of your life and at least have the option to stop it? Automated decisions dictate everything from how we get jobs to essential services or mortgages, for example, in rapid, nonchalant and unaccountable fashion. 

The privacy agency’s board members already recommended loosening opt outs for targeted advertising and training data that feeds artificial intelligence systems. Without opt-outs, companies can indefinitely train AI models on your personal data without consent, and because you said the word “baby,” the algorithm thinks you’re a parent and bombards you with parenting ads on every feed.

Californians complain about this stuff all the time.

The privacy agency doesn’t have to listen to the governor. Board members just have to read the voter-passed Proposition 24 and the privacy act statute, which directs them to draft regulations in the interest of privacy — not in favor of the interests of a few large tech companies.

More importantly, the right to privacy is enshrined in the first article of the California Constitution. By letting algorithms and AI take the reins, we relieve ourselves of responsibility — a comfort that comes at the cost of our own control. 

We are supposed to be in a new era of privacy, and California is supposed to be leading that charge. Instead, we’re willingly moving to the back of the line. We’ve heard these industry threats for decades now — that regulations will be too costly — yet tech companies have only grown and remain rooted in our state after 20 years of dominance. 

We can’t afford to let their tactics scare us.