25 leaders, 25 moments at 25 years: Alastair Mactaggart

The absence of U.S. comprehensive federal privacy legislation has been filled in recent years with the proliferation of comprehensive laws at the state level. California began the line of 19 state laws thanks to the relentless efforts of many stakeholders, but perhaps none more dedicated than Alastair Mactaggart. 

Mactaggart’s influential work helped lead to the California Consumer Privacy Act ‘s surprising passage in 2018, which took effect in 2020, and the ballot initiative that spawned amendments three years later through the California Privacy Rights Act. 

His advocacy began in 2016, after a conversation with a Google software engineer revealed the vast extent to which companies collect and use consumer data. The curiosity quickly turned into the motivation that spurred years of work toward finalization of the CCPA. 

"These giant corporations know absolutely everything about you, and you have no rights," Mactaggart said in 2018 remarks following the passage of the CCPA. "I thought, oh, I'd like to find out about what these companies know about me. Then I thought, well, someone should do something about that." 

The CCPA represented a major shift for U.S.-based privacy professionals as the EU General Data Protection Regulation was coming online as California’s law was passed. The two laws became foundational to the privacy compliance measures deployed across global jurisdictions. 

Mactaggart called the CCPA “a great stride forward” the day it was signed. No one knew then that he had more strides to come in the form of Proposition 24, the ballot measure for the amendments under CPRA, which he announced as a keynote speaker at the IAPP’s Privacy. Risk. Security. 2019 conference in Las Vegas.

Propelled by the Mactaggart-backed advocacy group Californians for Consumer Privacy, the measure significantly expanded the CCPA, including new rights, amended scope and the addition of sensitive personal information. The measure also proposed the California Privacy Protection Agency — a first-of-its-kind U.S. regulatory body tasked with exclusively enforcing privacy laws in the state. 

The ballot initiative was approved by California voters 3 Nov. 2020, not even a full year after the CCPA took effect. 

Mactaggart explained the urgency behind passing Prop 24 during a conversation with IAPP Editorial Director Jedidiah Bracy in October 2020. He feared industry would quickly dissolve the provisions of the CCPA if it didn’t get a swift update, noting, “I don't think legislation is a strong enough moat around the law, even with regard to privacy.” 

In that same conversation, Mactaggart advocated for California exploring an adequacy decision with the EU, which is still being discussed between the CPPA and the European Commission. He said receiving adequacy would be “great for consumers, because clearly one of the strongest protections is the GDPR right now. So, we in California deserve those protections. And if we're part of a larger framework, there’s less chance that I think these things go sideways.” 

In 2022, California Attorney General Rob Bonta appointed Mactaggart to the CPPA Board, furthering his imprints on California and U.S. privacy. As a board member, he provides input and perspective on the CPPA’s work, including enforcement and promulgation of regulations. 

More recently, Mactaggart and the board have worked toward helping the CPPA tackle regulations clarifying provisions for automated decision-making technologies, risk assessments and cybersecurity audits under the CCPA.