In response to the California Privacy Protection Agency’s request for feedback on draft rules, Consumer Reports (CR) submitted comments focused on cybersecurity audit requirements, risk assessments, and automated decision-making technology.
CR praised the agency for taking action, and explained how the rulemaking was well within the agency’s authority. CR highlighted nationally-representative surveys that CR has conducted which suggest that Americans are uncomfortable with the use of AI and algorithms in several high-stakes scenarios that the rules cover, and are in favor of receiving explanations similar to what the draft rules would provide, after AI is used in a high-stakes decision.
CR largely praised the agency’s cybersecurity audits proposal. CR argued that the Agency should strengthen requirements around risk assessments, including by recommendation that the Agency grant itself a formal mechanism to contest businesses’ self-assessments of the tradeoffs between the risks and benefits of their processing activities. Finally, CR discussed the proposed regulations around ADMTs, recommending the Agency improve the definition of ‘automated decisionmaking technology’, and add additional clarity to the opt-out right, right to appeal, and the post-decisions access right.
For more, please see the attached PDF