Points of Interest Summer 2019 Page 11 Potential Federal Preemption of Class Action Right? The CCPA provides that any provision in any contract purporting to waive a consumer’s rights under the CCPA is deemed to violate public policy and is void. And as noted above, the CCPA also provides a limited private right of action for data breaches, and allows a consumer to bring a class action for any such breach. These two provisions set up a potential conflict between the Act and the Federal Arbitration Act (the “FAA”). In recent years, businesses have managed class action liability by, at least in part, including in their customer contracts provisions that require the customer to arbitrate all disputes with the business. These provisions also often expressly prohibit class-wide arbitration, effectively requiring customers to waive the right to bring a class action in a dispute related to thebusinessrelationship. InDiscoverBankv. Super.Ct.,36Cal.4th148(2005),California’s Supreme Court held that such class action waivers are unconscionable and hence, unenforceable under California law. But in the famous United States Supreme Court decision of AT&T Mobility v. Concepcion, 563 U.S. 333 (2011), the Supreme Court overturnedtheDiscoverBankrule,holding that“[r]equiringtheavailabilityofclasswide arbitrationinterfereswiththefundamental attributes of arbitration and thus creates a scheme inconsistent with the FAA.” It is not hard to see the potential conflict between the CCPA’s declaration that any contractual provision purporting to waive orlimitaconsumer’srightsundertheCCPA is void, and Concepcion’s declaration that the FAA prohibits states from prohibiting class action waivers in arbitration clauses. This is a conflict that is unlikely to be resolved either by amendment to the CCPA or rulemaking by the Attorney General. Likely, this ambiguity will persist for years as the lower courts grapple with the argument. Heading East Asoftenhappenswithrespecttoconsumer protection laws that originate in California, the CCPA appears to be on the march Eastward. Privacy bills modeled on the CCPA have been proposed in New York, Washington state, Hawaii, Texas, Utah and others. And, no doubt, additional proposals will have been made in the time betweenwhenthisarticlewaswrittenand when it goes to press. While it is too early totellwhatlawswillultimatelybeenacted in these, and other, states, it is clear the CCPA is having nationwide effect. Business advocacy groups have pinned their hopes on Congress enacting federal privacy legislation that preempts state laws like the CCPA. Complying with a patchworkofprivacyregulationsacrossthe fifty states, they argue, would be unduly burdensome and expensive. At least one federal consumer privacy law has been introduced in the Congress by Senator Marco Rubio (R-FL) that would preempt such state privacy laws. However, given thecurrentpoliticalclimatewhenitcomes to privacy in general, privacy advocates appear to have the ear of both parties in Congress, and are lobbying hard against preemption. It is far from clear that a law that includes preemption could garner 60-votes in a divided Senate, and even if such a federal law could be passed, it is unlikely any such preemption would take effect before January 1, 2020 (and state attorneys general would no doubt challenge the law in court). Conclusion This article provides only an overview of some of the larger issues raised by the CCPA as businesses prepare for compliance. While there is hope of clarifyingamendmentfromtheLegislature or regulations from the Attorney General, businesses and attorneys should not assume that these bodies will come to the rescue with respect to all – or even some – of these problems before January 1, 2020. Accordingly, it will be up to those businesses and attorneys to chart the best course they can through the maze that is the CCPA. JosephW.Guzzettaisanattorneycurrently practicingatSeverson&Werson,P.C.inSan Francisco,California. Aciviltriallawyerwho hastakenmorethan10jurytrialstoverdict in the last 5 years, Mr. Guzzetta specializes inconsumerprivacyregulationinCalifornia and around the nation. He is the author of a forthcoming treatise focused on state and federal financial privacy regulation under the Gramm-Leach-Bliley Act and its state analogues. In October 2018, Mr. Guzzetta pre-released a chapter from that forthcomingtreatiseentitledTheCalifornia Consumer Privacy Act of 2018: A Guide to Compliance, which provides a detailed, up todateblueprintforbusinessesseekingto comply with the new CCPA. Mr. Guzzetta can be reached at jwg@severson.com or by telephone at 415-677-5622. Consumer Privacy Act – continued from page 10