(California) Testimony on the California Privacy Protection Agency’s Draft Regulations on ADMT, Risk Assessments, and Cybersecurity

Hello, my name is Kara Williams, and I’m a lawyer at the Electronic Privacy Information Center, or EPIC. EPIC is an independent nonprofit focused on protecting privacy in the digital age.  

EPIC was very disappointed to see significant weakening in the latest draft regulations on ADMTs, risk assessments, and cybersecurity. Strong rules are essential to ensure that Californians are protected from the well-documented harms to privacy and civil rights caused by the unchecked use of automated decisionmaking technologies. The original draft regulations would have been a significant step toward this goal, but with each new revision, and increase in pressure from the tech industry, the draft rules have become less and less protective for consumers.  

The California Consumer Privacy Act—and the voters—tasked this agency with adopting regulations that would protect their right to privacy. And as the only dedicated privacy agency in the country, this body is in the best position to develop thoughtful, well-crafted rules that meaningfully protect privacy, especially as the increasing use of AI presents new and pressing harms. Privacy harms include the harmful use of personal information in automated decisionmaking technologies, and the CCPA clearly authorizes the Agency to regulate ADMTs to protect California consumers.  

EPIC urges the agency to push back on industry’s attempts to weaken these regulations and instead restore the protections from earlier drafts to fulfill the Agency’s mission to safeguard Californians’ privacy. EPIC would also ask that the comment period be extended beyond 15 days to ensure we and other advocates can thoroughly review the numerous changes and provide comprehensive feedback.  

Thank you for your time and consideration, and EPIC is happy to remain a resource for the Agency.