CPPA board directs staff to pursue three privacy bills, including whistleblower incentives
Get AI-powered insights, summaries, and transcripts
Subscribe
Summary
The California Privacy Protection Agency Board on Nov. 7 voted unanimously to direct staff to pursue three proposed privacy measures — a whistleblower incentive and protection program, an expanded right‑to‑delete, and requirements for alternative consumer request methods — and to work with legislators on whether to sponsor them.
The California Privacy Protection Agency Board on Nov. 7 voted unanimously to direct staff to take three proposed privacy measures to the Legislature for the 2026 session and to use its discretion to support or sponsor those measures as they develop.
Deputy Director Maureen Mahoney presented staff’s package: a whistleblower award-and-protection program modeled on elements of federal whistleblower systems, an amendment to extend the right to deletion to all personal information a business holds about a consumer (including third‑party data purchases), and a requirement that online‑only businesses offer alternatives to email‑only submission of access, deletion and correction requests.
“Whistleblower protections and incentives can help bring unknown violations to light and enhance the agency’s ability to enforce consumers’ privacy rights,” Mahoney told the board, outlining a three‑part concept: an award program, a “special designation” that lets the enforcement division partner with whistleblower attorneys in certain cases, and anti‑retaliation protections.
Board members questioned enforcement capacity and program design. The agency’s enforcement lead explained whistleblower matters are distinct from the high volume of consumer hotline complaints and are typically submitted with attorney support and evidentiary materials, allowing the agency to control case volume through discretionary designation.
Consumer and privacy groups at the meeting supported the proposals. Matt Schwartz of Consumer Reports said whistleblowers have exposed critical corporate misconduct and urged the board to move forward. Industry groups urged caution; TechNet argued existing whistleblower statutes and very recent legislation (SB 53) may already offer protections and recommended careful coordination with businesses.
After discussion, Board Member Hamer moved the motion directing staff to pursue the proposals and to allow staff flexibility to support them up through sponsorship, with parameters discussed by the board. Board Member Liebert seconded. Roll‑call votes were: Hamer — Aye; Liebert — Aye; McTaggart — Aye; Chair Urban — Aye. The motion carried 4–0.
The board’s direction does not itself create law. Staff told the board it will work with legislators on bill text and return to the board for decisions about formal sponsorship prior to any bill’s introduction.