By Andrew Cohen
California Gov. Gavin Newsom has appointed Berkeley Law Clinical Professor Jennifer Urban ’00 chair of the California Privacy Protection Agency (CPPA). She and four other experts in privacy, technology, and consumer rights will form the board of the new administrative agency charged with protecting the privacy rights of consumers over their personal information.
The CPPA is a vital component of the California Privacy Rights Act. As the agency with full administrative power dedicated to privacy and data protection, the CPPA is unprecedented in the United States.
In creating the agency, Urban says the state “demonstrates national and international leadership.” She adds that “California, with explicit privacy protections in our state constitution, many existing innovative privacy laws, and leadership from an expert attorney general’s office, has long been a leader in privacy. But as the world grows ever more data-driven, a dedicated body to protect consumer privacy rights, provide guidance to businesses, and enforce the law, is necessary.”
Urban is the director of policy initiatives for Berkeley Law’s Samuelson Law, Technology & Public Policy Clinic and a co-director of the Berkeley Center for Law & Technology.
“The California Privacy Protection Agency is a badly needed innovation given the importance of data to our economic system today,” says Samuelson Clinic Director Catherine Crump. “The agency will help California consumers by making sure their privacy is protected, while also giving businesses the clear rules they need to operate. Jennifer’s expertise in data privacy and her personal integrity make her the ideal choice to lead the agency’s inaugural board.”
Well-rounded expertise
An authority on intellectual property, privacy and data protection, and security, Urban works with technologists and academics. Their collaborations develop understandings of how new technologies and the regulatory structures around them interact with civil liberties, innovation, and creative expression.
Urban and her clinic students represent clients in information policy-related public interest cases, addressing areas such as individual privacy rights, copyright and free expression, artists’ rights, government surveillance, biometrics, and defensive patent licensing. With Professor Chris Hoofnagle, she teaches interdisciplinary courses in cybersecurity that emphasize how international relations considerations, legal standards and rules, and economic frameworks enable and constrain security technologies and policies.
“Professor Urban’s appointment to this historically significant new institution will make Berkeley Law’s spirit — its values, and substantive and procedural expertise — a parent of the Consumer Privacy Protection Agency,” Hoofnagle says. “Her well-rounded practice and academic experience, along with her care and respect for institutions, will help the agency realize a culture of stakeholder buy-in, careful deliberation, and humble responsibility for the immense task of realizing a trustworthy data economy.”
In 2018, California became the first state to equip consumers with new privacy tools and privacy rights under the California Consumer Privacy Act. State voters broadened those protections in approving Proposition 24 on Election Day in November, creating the agency.
It will have full administrative power, authority, and jurisdiction to implement and enforce both that act and the California Privacy Rights Act. The agency can bring enforcement actions related to either before an administrative law judge, and the state’s attorney general will retain civil enforcement authority over both acts.
A timely initiative
“Californians deserve control over their personal information, protection from privacy-invasive practices, and the ability to trust that their data is secure,” Urban says. “Businesses need clear rules and a level playing field that allows them to build privacy-protective products and services.”
With the COVID-19 pandemic expanding the public’s already enormous reliance on the internet, and the spread of data mining, protecting people’s digital identities and private information has become increasingly difficult — and important.
Samuelson Clinic Associate Director Erik Stallman ’03 calls Urban an optimal fit for her new post, saying she is “frequently among the first to identify and study privacy, security, and intellectual property issues raised by emerging technologies.”
Her awareness and expertise, he notes, place the Samuelson Clinic at the vanguard of numerous public policy debates at the intersection of law and technology. “Jennifer’s students acquire a mastery of substantive law, lawyering skills, and ethical duties related to the technology law and policy matters they work on,” Stallman says. “This is why so many of them go on to become trusted leaders in their respective legal fields.
In spearheading this new endeavor, Newsom says Urban and her fellow appointees “represent a new day in online consumer protection and business accountability.”