On March 11, 2020, the California Office of Attorney General released a second set of revised draft regulations under the California Consumer Privacy Act (CCPA). Some changes in the second revised set of draft regulations include moving requirements to different subparagraphs. However, other changes of note include:
- striking § 999.302, titled “Guidance Regarding the Interpretation of CCPA Definitions,” for the definition of “personal information”;
- removal of the “Opt-Out” button graphic;
- adding under § 999.305(d) that “[a] business that does not collect personal information directly from a consumer does not need to provide a notice at collection to the consumer if it does not sell the consumer’s personal information”;
- adding under § 999.305(f) that “notice at collection of employment-related information is not required to provide a link to the business’s privacy policy”; and
- modifying § 999.08(c) for privacy notices by removing requirement to disclose “the categories of third parties with whom the business shares personal information.”
Like previous iterations, the revised regulations do not shed any further light on the scope of CCPA’s definition for “sale” of personal information – a concern for which businesses repeatedly have sought clarity.
The Attorney General’s website reports that this second set of draft regulations are subject to another public comment period, with written comments due by March 27, 2020, at 5:00 p.m. (PST).
[View source.]
