California's new data law is a deliberate step forward that shows the power of small states to influence broad changes in the technology industry.

By Xische Editorial, January 29, 2020

If you are looking for evidence of the power of small states, consider California’s new data laws. Yes, California is not an independent country but it is home to the world’s fifth-largest economy and has been a trailblazer when it comes to forward-thinking legislation. On the 1st of January, California became the first state in the United States to enact wide-ranging data regulations aimed at protecting consumers online. Instead of tailoring specific policies to residents of California, many companies such as Microsoft simply changed their data policies for everyone. You likely received an email outlining how a company or media outlet you follow has changed their terms and conditions in the wake of California’s new laws. 

The California initiative is also adding weight to calls for fresh national data regulations in the US. As the world’s largest economy and a major innovator of technology, any national data protections the US ratifies will have a dramatic ripple effect on the global technology ecosystem. 

Let’s get into the details of the new California law. Curiously, it has a narrow focus. Officially named the California Consumer Privacy Act (CCPA), the law is focused on data. It targets the ability of private companies to mine data from users and then reuse it. “The issue of selling consumer data is so fraught that many companies are unwilling to discuss it publicly,” the New York Times reports. “Oracle, which has sold consumer information collected by dozens of third-party data brokers, declined to answer questions. T-Mobile, which has sold its customers’ location details, said it would comply with the law but refused to provide details.”

So what exactly does this all mean? Vox notes that “for all the discussion about our online data and the privacy concerns surrounding it, it’s sometimes hard to wrap your head around what companies really know about us, and what it means for us when they gather and sell this information. This data can be deeply personal.” 

Under the CCPA, Californians have the right to know what personal information is being collected about them, either before or as that information is collected. Additionally, Californians now have the right to know if their personal information is being sold or disclosed by the companies collecting it and to whom. Finally, Californians are now able to say no to the sale of their personal information. On the surface, these changes seem logical – why don’t we have the right to control our own data? But they are indeed radical in the current digital climate.

The way that data is collected, stored, and analysed is almost impossible for the average consumer to understand. The CCPA will add a much-needed layer to the process. Again, Vox notes that “businesses must now notify consumers what personal information they collect about you and why. And some companies may give people all across the US the same opt-out and deletion rights they give to Californians because it’s easier to roll out a widespread change.”

This is the power of small states before our eyes. California identified a clear problem in the technology ecosystem and because of its ability to quickly pass legislation, people around the world will benefit. Writing in The National newspaper, Xische’s Direction of Strategy expanded this idea to focus on how the UAE could build its knowledge economy by enacting similarly sensible regulations.

“Regulating Big Tech is not a straightforward process, therefore we need to be experimenting with many different approaches,” Ames noted. “Instead of relying on super-powers such as the US to draft complex data regulations, we should look to smaller countries that have growing technology ecosystems.”

Ames continued by noting that “there is no single way to regulate modern technology. We have never faced such powerful private companies that have data on virtually all aspects of our lives. Sensible regulation will arise out of a process of trial and error, which is exactly why smaller countries can lead in this area.”

Therefore the solution to the challenge is exactly what California has done: experimentation. By no means is the CCPA the greatest piece of data legislation in history. Not by a long shot. But it is a first step that will cause other important bodies to act. That’s how Ames ends her argument as well: “We need to experiment to find the measures that will safeguard consumers while not stifling innovation. Such a goal is in everyone’s interest. So, what should be done? Pass measures that designate data as a public good and give the government a greater role in demanding that private companies adhere to better standards of data protection. Small states can and should lead the way.” California is showing us the path forward. Now it is time for us to follow with our regulations closer to home.