The California Consumer Privacy Act ("CCPA") was enacted in early 2018 as a political compromise to stave off a poorly drafted, and plaintiff’s friendly ballot initiative. Although the CCPA is scheduled to go into force in early 2020, there is a great deal of confusion regarding the requirements of the CCPA, including the degree to which it aligns with other privacy regulations such as the European General Data Protection Regulation (“GDPR”).
To help address that confusion, BCLP published the California Consumer Privacy Act Practical Guide, and is publishing a multi-part series that discusses the questions most frequently asked by clients concerning the CCPA.
Q. What rules will California’s Attorney General propose to interpret the CCPA?
The CCPA requires that California’s Office of the Attorney General adopt rules and regulations addressing the following topics within the CCPA:
Issue
|
Status
|
|
1. Definition of “Personal Information.” Update (if needed) the definition of personal information to include additional categories to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns.1
|
The attorney general has not proposed any draft rules.
|
|
2. Definition of “Unique Identifiers.” Update (if needed) the definition of “unique identifiers” to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns, as well as to facilitate the ability of a consumer to make an access request.2
|
The attorney general has not proposed any draft rules.
|
|
3. Exceptions for compliance with state law. Establish exceptions needed to comply with other state laws.3
|
The attorney general has not proposed any draft rules.
|
|
4. Exceptions for compliance with federal law. Establish exceptions needed to comply with federal laws.4
|
The attorney general has not proposed any draft rules.
|
|
5. Opt-out of sale requests. Provide guidance conceding the submission of requests by consumers to opt-out of the sale of information.5
|
The attorney general has not proposed any draft rules.
|
|
6. Opt-out of sale requests. Provide guidance conceding the submission of requests by consumers to opt-out of the sale of information.6
|
The attorney general has not proposed any draft rules.
|
|
7. Opt-out of sale implementations. Provide guidance to businesses on how to comply with a consumer’s request to opt-out of the sale of their information.7
|
The attorney general has not proposed any draft rules.
|
|
8. Opt-out logo or button. Develop a “recognizable and uniform opt-out logo or button” that could be used by businesses.8
|
The attorney general has not proposed any draft rules.
|
|
9. Increase gross revenue threshold for businesses. Increase, every other year, the $25 million gross revenue threshold that triggers whether the CCPA applies to a business to account for inflation.9
|
The attorney general has not proposed any draft rules.
|
|
10. Business disclosures. Establish procedures (and any exceptions) “necessary to ensure” that the notices and information that businesses provide under the CCPA are conveyed in a manner that may be easily understood by the average consumer, are accessible to consumers with disabilities, and are in the language primarily used to interact with consumers.10
|
The attorney general has not proposed any draft rules.
|
|
11. Financial Incentive Offerings. Establish guidance conceding financial inventive offerings.11
|
The attorney general has not proposed any draft rules.
|
|
12. Access requests. Establish rules and procedures to facilitate access requests.12
|
The attorney general has not proposed any draft rules.
|
|
13. Miscellaneous. In addition to th
|
The attorney general has not proposed any draft rules.
|
In addition to the issues identified above, the Office of the Attorney General is embowered to adopt “additional regulations as necessary to further the purposes” of the CCPA.
[View source.]
