The unlikely activist behind the nation’s toughest privacy law isn’t done yet

Alastair Mactaggart’s push for a groundbreaking privacy law was conceived in the bathroom.

In his own retelling, the real estate developer’s story had always begun with a Google engineer. The engineer told Mactaggart he would be “horrified” to know how much data Google collects on its users. Soon after, Mactaggart — a political novice — would learn about ballot initiatives, a powerful if controversial tool Californians can use to directly make state policy.

But he told CNN it was “literally a shower thought” that led him to marry the two ideas, paving the way for a landmark California law regulating apps, websites and tech companies that could set a precedent for the rest of America. Even the law’s biggest critics, such as the Internet Association, a tech trade group, have acknowledged its passage as “historic.”

“One day in the shower,” Mactaggart said, “I was like, ‘You know what? We should have an initiative on these things. It’s a pretty cool idea.'”

As Congress considers writing its own federal privacy bill — with some lawmakers looking to California as a model — Mactaggart is on the move again, embarking on a fresh campaign to put digital privacy on the California ballot once more. If he succeeds, businesses including Google and Facebook could face even stiffer regulations than under the California Consumer Privacy Act, which granted Internet users new rights to their data last year after Mactaggart introduced a ballot initiative, then withdrew it and hammered out the legislation with state lawmakers.

In an extensive interview in his Oakland office, Mactaggart told CNN his new ballot initiative is meant to build a moat around the fledgling CCPA, out of concern that companies opposed to tougher privacy rules will eventually chip away at the consumer protections. He also wants to toughen the CCPA and give consumers the right to prevent companies from selling insights about their precise geolocation history, sexual orientation and other forms of highly revealing data, particularly for advertising purposes.

It’s the latest development in a remarkable and unlikely political journey that has transformed the 53 year old developer from the head of a successful family real estate business in the Bay Area to someone the New York Times once called “the most improbable, and perhaps the most important, privacy activist in America.”

Mactaggart knows his new initiative could be perceived as evidence of a never-ending crusade. But he isn’t an ideologue, he said.

“I do not want to do this for the rest of my life,” he said. “I’m not a politician. I don’t want to be a politician. I just want to get a good law in place. It was a little daunting to see how hard business tried to just destroy it this year.”

A multimillion dollar fight

The campaign to put digital privacy on the ballot even before regulators have begun to enforce CCPA is an attempt to short-circuit what Mactaggart describes as a multi-year, nationwide, deep-pocketed effort by industry to weaken privacy enforcement. This year, a raft of industry amendments sought to change the law before it takes effect in January.

“If businesses hadn’t spent nine months trying to gut this thing, maybe I’d feel differently,” he said. “But you know, things changed.” Key provisions of the new ballot measure, he added, will help shield CCPA from “someone coming along in the dead of night and sticking a knife in it.”

Ballot initiatives in California are a form of direct democracy: They work essentially by circumventing the state legislature and the governor’s office. If it passes, Mactaggart’s proposal says lawmakers will still be able to amend CCPA with a 50% vote. But any changes would have to serve the original intent of the legislation to protect consumers — and not undermine it.

Asked how much he is willing to spend to counter it and ensure his initiative succeeds, Mactaggart demurred. But he said he is willing to spend at least what it takes to get on the ballot.

The last time he tried to bring the issue to voters, Mactaggart spent more than $3 million. The new campaign will likely involve even more money, he said, because this time, more signatures are required.

The next stage in the battle to protect our privacy

Mactaggart’s push to bolster California law also stems from a frustration with Washington, where he said a divided Congress and an under-resourced regulatory system cannot hope to compete with legions of corporate lawyers and lobbyists.

“The richest, most powerful companies in the world have spent decades telling everybody in D.C., ‘Leave it up to us, we’ve got it,'” Mactaggart said.

There are signs that may be changing. The House has proposed giving the nation’s top privacy watchdog, the Federal Trade Commission, up to $40 million in new funding. The FTC’s chairman, Joseph Simons, told lawmakers roughly half of that could be spent hiring dozens of new technologists and economists and doubling the size of a task force investigating tech companies.

In other ways, though, Washington remains deadlocked. Efforts to produce a federal privacy law have largely stalled after lawmakers missed a slew of self-imposed deadlines this year. The resulting policy void is one that’s increasingly being filled by states — and by California to a growing degree.

Mactaggart’s newest proposal doesn’t try to make tech companies vulnerable to private lawsuits for all violations of CCPA, something that was on the table when the law was being crafted. In CCPA’s current form, companies are only liable to consumers when it comes to violations of CCPA’s data breach provisions.

But Mactaggart’s new ballot initiative could toughen CCPA in a couple of significant ways. Among his top wishlist items is the creation of a new category of sensitive personal information under California law, including geolocation data. Under the new provision, Google could still use a person’s whereabouts to provide accurate service through its own apps such as Google Maps, but consumers could forbid Google from sharing that information with virtually anyone else.

Mactaggart has also proposed a new, standalone data protection agency modeled after those found ins the European Union. The concept raises the prospect of similar agencies being founded across all 50 states, leading to a patchwork of state regulation that critics have said would be unreasonably complicated and could tie up small businesses in red tape.

Tech titans like Facebook have argued that while large companies can more easily comply with strict regulations, smaller businesses lacking the same resources might not. In response, Mactaggart refers back to the regulatory headaches of the industry he knows best: real estate.

“In real estate, if you have a paint fleck on the sprinkler, you get dinged these enormous number of points. It’s a really big issue,” he said. “Well, actually, it probably makes sense, because someone at some point probably died in a fire because the sprinkler was jammed. And the point is, we still do okay.”