On October 12, less than a month before California will vote on a referendum that would significantly overhaul the California Consumer Privacy Act (CCPA), the California attorney general released a third set of Proposed Modifications (Proposed Modifications) to the implementing regulations for the CCPA. These Proposed Modifications come only a few months after the CCPA regulations went into effect on August 14, 2020. This third set is subject to a public comment period, with a deadline to submit written comments by October 28 at 5:00 p.m. PST.
The Proposed Modifications, if adopted, would require the following:
Requires Offline Notice of the Right to Opt Out. For businesses that collect personal information offline (e.g., in-person or via telephone), the Proposed Modifications require businesses to provide an offline notice, facilitating consumers’ awareness of their right to opt out. The proposed change includes illustrative examples for compliance. For example, for businesses that collect personal information in a brick-and-mortar store, notice may be provided by “posting signage in the area where the personal information is collected directing consumers to where the notice can be found online.” For businesses that collect personal information over the phone, notice can be provided orally during the call in which personal information is collected.
These Proposed Modifications demonstrate that regulators no longer focus solely on what information a business elects to disclose about its data collection and sharing practices. Rather, how such information is disclosed will be a key factor in deciding whether businesses are being “transparent” about their data privacy practices and, if the Proposed Modifications are adopted as is, if they are complying with the law. It will be interesting to observe whether the attorney general will establish an office for businesses to get “pre-approval” of a designed process to avoid the ambiguity created by this proposed rule.
Modifies Proof Required for Authorized Agent. The Proposed Modifications seek to modify the “authorized agent” provision of the implementing regulations by allowing businesses the discretion to require an authorized agent, who is submitting a request to know or a request to delete on behalf of a consumer, to provide “proof that the consumer gave the agent signed permission to submit the request.” Also, businesses can continue to require consumers to directly verify their identity with the business or confirm they provided the authorized agent permission.
As the CCPA and its implementing regulations continue to change, especially with the upcoming California Privacy Rights Act (aka CCPA 2.0) on the November ballot, businesses must continue to be up to date with the statutory and regulatory aspects of the law. For information on how to comply with the CCPA, see Troutman Pepper’s article series on CCPA enforcement available here. Also, for information regarding the upcoming CCPA 2.0 set to appear on the California November 2020 ballot, see Troutman Pepper’s article here.