Amicus Brief Urges Cautious 9th Circuit Review of AB-2273's DPIA Tool

The Institute for Law, Innovation & Technology at the Temple University Beasley School of Law takes no position in the appeal from California Attorney General Rob Bonta (D) to reverse the district court’s injunction that blocks him from enforcing AB-2273, the state’s Age Appropriate Design Code (see 2312140003), said the institute's amicus brief Wednesday (docket 23-2969) in the 9th U.S. Circuit Court of Appeals. The district court took a “notably broad view” of commercial speech and determined that essentially all of AB-2273's components “were facially unconstitutional,” it said. For the sake of “doctrinal integrity alone,” the 9th Circuit “may choose to revise, remand, or reign in aspects” of the district court’s decision, it said. But under all circumstances, the institute urges the 9th Circuit to “carefully consider” the statute’s data protection impact assessment (DPIA) risk management requirement, it said. It should also consider “what DPIAs actually are,” and where and how they are used, it said: “Categorically invalidating a state law with potentially national and international implications should, at the very least, be premised on an accurate and nuanced understanding of this important and widely used technical tool.” DPIAs trace their origins to federal privacy law from the 1970s, said the brief. For the past 20 years, large federal agencies have regularly conducted privacy impact assessments, which are “functionally and substantively similar” to DPIAs. These requirements help ensure that federal agencies “consider appropriately tailored data collection and processing tied to the purposes for which such records are created and maintained,” it said. DPIAs aren’t “an entirely novel or foreign creation, contrary to how they are sometimes misperceived,” it said.