Governor Newson recently signed two amendments to the CCPA strengthening protections for certain data types. The changes go into effect January 1, 2024.
One of the amendments, AB-947, extends the definition of “sensitive personal information” to include citizenship and immigration status. Current categories of sensitive personal information include precise geolocation, racial or ethnic original, religious beliefs, and genetic data. Citizenship and immigration status are already considered sensitive data under privacy laws in Connecticut and Virginia. Collecting sensitive personal information in California triggers certain notice, use, and opt-out rights.
CCPA currently allows businesses to cooperate with law enforcement and government agencies by providing personal information that is requested pursuant to official investigations. Now, AB 1194 specifically carves out reproductive health data. This means that information related to “accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services” need not be provided in an official investigation. It does not limit a business’s obligations to preserve information in a civil proceeding or where required by law. These amendments were prompted by heightened concerns involving government access to records of individuals seeking reproductive healthcare following the Dobbs decision at the Supreme Court. This follows trend with other types of California amendments strengthening reproductive privacy protections. It also follows other states and FTC’s heightened concerns about information involving a person’s health that might not be covered by HIPAA.
Putting it into Practice. Businesses should refresh their data mapping exercises to identify where they may collect personal information related to citizenship, immigration status and reproductive health. For citizenship or immigration status information, the CCPA’s sensitive personal information requirements should be adopted.
