How California Is Building the Nation’s First Privacy Police

Tracy Rosenberg, executive director of the nonprofit Media Alliance, a Bay Area public interest group that also works with Oakland Privacy, a community group, said the agency would face “a certain amount of political pressure.” “We really don’t know how the governor and Legislature will react if there is a pullback due to the measures taken by the agency.”

The agency’s advocates said its independence was partially protected by its structure, with unpaid board members appointed separately by different elected officials. Mr Soltani described the initial funding as “like the upfront payment in a game of poker” as voters “purchased” at least $10 million, but said the Legislature could give more.

The agency’s first task will be to translate the sweeping state privacy law into detailed regulations for industry. This runs a spectrum ranging from how data is used for targeted ads to how algorithms use personal information to make automated decisions, to newer areas of the law. The law also requires businesses to abide by the privacy preferences that online users set in their browsers; It is up to the institution to decide what this means in practice.

Eventually, the agency will have the ability to enforce its rules. Businesses may also need to submit audits of cybersecurity risks to the organization. He sought input on what exactly these inspections should include.

The agency has asked the public, nonprofits and businesses to submit comments to guide their initial rule. Privacy activists and industry groups have left hundreds of pages of comments trying to influence the agency’s decisions. For example, Google has asked the regulator to write rules that provide “the flexibility for businesses to respond to consumer requests with substance over form” and comply with privacy laws in other states.

“As the California Privacy Protection Agency continues its work, we will continue to work constructively to protect the privacy of our users,” a Google spokesperson, Jose Castaneda, said in a statement.

The Privacy Protection Agency’s board announced in February that it will likely hold workshops this month to get more comments from privacy experts and academics. At a meeting that month, Mr. Soltani said the group will likely issue its first arrangements later in the year so that it can balance staffing with the complex questions it needs to address.

“We build the car as it drives,” he said.