**Colleen**
We are here. It's Friday. We're recording another huddle. Privacy news stops for no one. Even when Friday morning is a little tricky, we have to be honest with y'all. We almost didn't make it to the recording today. Alisa, Celine, who wants to share first? It was dicey.
**Alysa**
It was really dicey. You know, it's summer. It's August first and my daughter came home from sleepaway camp and at ten pm last night said her head was a little itchy. And I think every mom kind of immediately goes to, uh-oh. I'm lucky enough to live in an area where there is ice ladies who are wonderful. And an eight am visit this morning strand by strand, the Hutnik household is now clean. But yeah, that was my morning.
**Colleen**
Talk about a summer camp nightmare. Well, we made it and plenty to talk about. Celine, it's such a pleasure to have you on. Welcome. Thanks for joining.
**Celine**
Thank you. Glad to be here.
**Colleen**
Would love for folks who maybe haven't seen you on yet. Can you tell us a little bit about your journey and what brings you to this conversation with Alisa and me today?
**Celine**
I recently joined Kelly Dry, a privacy group of special counsel, and I joined from the California Privacy Protection Agency about three months ago, where I was for about a year and a half in enforcement. I joined Mike Mako and the great team there right when the enforcement division was getting started. And before that, I was in house at Instacart for a couple years and was in private practice before that. I joked that I've been on the inside, the outside, and the other side.
**Colleen**
I recall when Alisa told us, Ketch Team, that you were headed over to Kelly Dry, that sounded so amazing to have that perspective of a former enforcement attorney there. So Alisa, tell us about bringing Celine onto the team.
**Alysa**
Celine, just for the sake of being Celine, is amazing and really just smart and thoughtful and practical. So just the chance to have her work on the team is amazing. But two, you know, enforcement is up. I've mentioned how many state enforcement privacy cases just are exponentially on on the rise. And we all have blind spots no matter where you're sitting. And it's just really helpful to have a lot of brains that all look at it with a different lens, different set of experiences because I think we end up issue spotting, coming up with creative ways to address and certainly being prepared to handle the investigations.
**Colleen**
Celine, the perspective shift going from enforcement to private practice, are there differences or really a lot of the same challenges from both viewpoints? Tell us about what you're seeing.
**Celine**
Yeah, so I'm very I'm pro consumer. I always like to put myself in the shoes of the consumer when I advise. And so, I was on the enforcement side, it was always really interesting to look at it from that perspective. Going back, even after a year and a half, to private practice has been really interesting. Just to see what businesses are struggling with opt outs are really an issue, and I know that both of you talk about that a lot. I think that really is tricky for businesses to understand that you need to be able to honor the consumer's choice to opt out. And a lot of stuff needs to happen on the back end, and it needs to happen in the right way. So, that's one area that is top of mind, and should be top of mind for businesses. And then on the litigation side, which is an area that I wasn't really necessarily as focused on when I was on the enforcement side, I was just amazed at the number of SIPA claims and that litigation. Really blown away. It's literally a tsunami of cases. Basically, it's the cost of doing business online or having a website. And even businesses that are complying with the CCPA are finding themselves in these situations. And what's a little bit unfortunate about it is that you have businesses that are now focusing on fighting these claims instead of actually putting that effort and those resources into compliance and really making the consumer journey one that is thoughtful and that complies with the requirements. So you have this kind of double standard with this old law that has been repurposed, and then a law that is really supposed to be our comprehensive privacy law in California that's being pecked at, and businesses not always being able to dedicate resources to fighting on all fronts. So that would be my two main takeaways.
**Colleen**
Still so much activity on the wiretapping front. Alisa, you were mentioning as we were chatting ahead of this call an update on the CEPA bill, right?
**Alysa**
Yeah, I know certainly for so many companies who are dealing with a tsunami that Celine mentioned, there's hope, maybe there was this bill and it would come out that would be clear that if you're complying with CCPA, then your practices on the web are not in violation of wiretap. I'm still optimistic about the bill, but it got moved to a two year bill. So we're not going to see a solution in twenty twenty five. I think the last version of it also didn't have a retroactive application. And so there's a lot of cases now, there are certainly some decisions getting passed motion to dismiss. And even on the trap and trace to the point of what is compliance if even if you did go the full consent model, that consent is not a defense for those trap and trace claims. So I think there's just really big existential questions about what is the internet in the way that it can be lawful and companies can do business without being really vulnerable to pretty expensive legal exposure.
**Colleen**
Are there any new trends or moves you're seeing when it comes to what an in house counsel should be doing to prepare?
**Alysa**
So there's not a silver bullet. That's the bottom line answer, but there's certainly a lot of mitigation measures. And I think so much of planting a flag and being extra interesting is having the unforced errors. And so step one, if you are doing a banner, what does it say? What are the choices you're offering? Are they dark patterns? Are they misleading? Are they incomplete? You're focusing on cookies as opposed to the issue that Celine said in terms of actual full choices. And then syncing timing. If you're offering a choice where it's illusory because your backend practices are gonna make certain things fire no matter what, yeah, that's a problem. So I think there's still plenty of room for hygiene that can make your exposure a whole lot less, make you less interesting. I continue to have empathy for my in house friends. There's a lot going on and there's new stuff constantly also on the edge. I think the hardest part is connecting the dots on the back end, really being able to have teams work together, the cross functional aspect and on technical side with opt outs in particular and trackers and with the SIPA litigation, it's really more important than ever, in my opinion.
**Colleen**
Completely agree. That reminds me of Stephanie Liu, who's a marketing and privacy senior analyst at Forrester, just released a new paper this week on key roles when you're building your privacy team. And she's really suggesting that it's split across not just privacy legal, but of course security and risk, then also marketing. Think she said less than five percent of companies have a marketing person that's actually named to the cross functional team. So I completely agree, Selena. It's a missing link for sure. Let's talk about another challenge that Alisa, mentioned is a sleeper issue that folks aren't maybe paying enough attention to right now, which is the surveillance pricing bill in California. Can you give us the what it is and why it matters synopsis?
**Alysa**
Sure. You know, think we can be so focused on what's the next comprehensive privacy law, what's the next amendment to a state comprehensive privacy law. And this one, I think, some ways because of the title and the way that media has covered it, seems like it's a very narrow issue. It's called surveillance pricing. I think it's covered in that way. The horror story that gets mentioned, flight prices are going to change because they know you need to go to a funeral and so your price is going to be particularly high. It's personalized to your detriment in that way. I think we all have concerns with that type of practice. I think the concern that I have as I look at this bill, it's Assembly Bill four forty six, is that it's got such broad definitions on what is surveillance pricing that so long as there's this nexus to price or a discount and in part based on use of personal information using any observation methods about one's behavior, that could trigger it and just as that is unlawful unless it fits in within a few very, very narrow exceptions. And so there is a private right of action. And if you look at this bill based on that very, very broad language, you can anticipate that any kind of interest based advertising that involves some type of ultimate discount, which is a big part of a lot of advertising, is encompassed. And so forget SIPA. Does this now become the new enemy for businesses in determining is it legal to do interest based advertising to have a loyalty program? In the state of California, it calls out loyalty programs, but there's some really impractical, very narrow criteria that you'd have to meet in order to fall outside that. I don't know a single loyalty program that could meet that criteria. So yeah, that is one that I'm tracking for sure.
**Colleen**
Wow, that's fascinating. What a slippery slope for businesses that could impact just about everybody doing any kind of loyalty program or advertising. Celine, what do you think is the thinking from a regulatory enforcement perspective, how this affects how they're handling enforcement today?
**Celine**
I don't know, but what I do know is that just reading that bill, I read it as saying you can do certain things under CCPA, but you can't do things under this law. So, one is it? And I think it becomes really challenging. We're talking about having a comprehensive consumer privacy law. We have an agency that's tasked with enforcing it along with the AG. And I think that it's really important for businesses to understand what they can't and can't do. So same issue as with CEPA. You're complying under CCPA, but now we're introducing this. And I think that's a real challenge for businesses because a lot of what's being addressed in this bill was already addressed in many ways by the CCPA. They're carved out. So, like, the CCPA doesn't have any authority to enforce this bill as it's written. So, it means that you now have conflicting laws, And I think for businesses, it's a challenge. And I think it's a challenge on the enforcement side. If power is at the local DA level, the local DA's, what we've seen is they often hire plaintiffs firms to represent them. And so then you just think about it from a policy perspective of who is writing California privacy policy because it matters how it's enforced. If the CPPA is cut out of it, who has the most resources to keep it moving forward? Is it gonna be the AG's office? Who's leading California privacy when you have things like this that are in conflict?
**Celine**
Yeah, and I would add, how is it being interpreted? Having been at the agency, they've got a great team with dedicated technologists, they know what they're doing, and you now have the risk of having more cooks in the kitchen. Obviously, the agency here would not be implicated, but how do you interpret California law? Because there's the statutory element, of course, of a law when you have a comprehensive law, but it's also how it's being interpreted and applied. I think that there's a big risk when you have too many cooks in the kitchen and some inconsistencies, both from a substantive level and an enforcement level, if that makes sense.
**Colleen**
For an in house program manager, the list keeps getting longer of the inquiry source that you might receive on any given day from yet another body or place.
**Alysa**
Yeah, we get asked, okay, what's the strictest standard that I can bill to you for the next two years? Just tell me what the worst is so I at least know what that is. And I don't even know how to explain the worst on this because I don't know how you do this and not like, don't roll out loyalty programs for California, which is one of the largest economies in this country. That's not a viable option. And so rock in a hard place. You tell your marketing team, stop the loyalty program. They're going to laugh in your face. It's not an option.
**Celine**
Yeah. Well, businesses spend a lot of resources rolling out their compliance programs. And so when you have all these shifts, people talk about the craziness at the global level in the United States with all these state laws. But even within California, it's a little bit tricky. Not an easy thing for businesses. I had been on the business side, went to the enforcement side, and came back. And you forget sometimes how much businesses are really trying to comply with increasingly difficult privacy landscapes. So, really interesting.
**Colleen**
The patchwork within the state. We talk about the patchwork across the country, but we've got a California patchwork, which is just mind boggling. It's wild. And it makes me think of conversations we had in the past where you've talked about, it seems more critical than ever to just document your processes and show your work because you're probably not going to get it exactly right to every single law. But if you can show that you had a good process leading up to it or a solid foundation of thinking why you did something, that should help a lot in case of investigation.
**Celine**
I think it's really important for consistency within a business, but also really it shows the thought process that went into compliance efforts and decisions that were made for whatever reason. I think it's super important. And that's again where having input from different stakeholders is really important.
**Colleen**
Across these different laws and bills, there's a lot going on. It's going to be a busy fall. And so in spirit of that and to help in house counsel continue to understand what's going on and get educated and speak with peers across the Catching Cali dry teams, we've been cooking up a really exciting event this fall. It's going to be October twenty third in San Francisco. Alisa, you've been our key partner in putting this together and framing this event.
**Alysa**
It's the conference that I would want to attend, the control freak that I am. When I go to conferences, sometimes you walk away and you're like, I met a lot of people. That was really great, but I didn't get to to the substance of what are those issues I'm wrestling with and how are other people thinking about them. And so we're just cutting right to the chase. And I think really trying to focus on what are all of those issues that we want to have weigh in, we want to have people speak to.
**Colleen**
Absolutely. So folks, this is not hypothetical. It's on the books October twenty third in San Francisco. We will be releasing more information, some early speaker highlights, how to save your spot in just the next week or so here. Stay tuned and we'd love to see you there. So in the meantime, Elisa, Saline, thanks for joining me as always. It's a pleasure.
