CCPA: When “Final” Doesn’t Mean What You Think It Means (with apologies to The Princess Bride)

Mintz - Privacy & Cybersecurity Viewpoints

Earlier this week, the California Department of Justice unexpectedly released a third set of proposed modifications to the CCPA regulations. This move took place only two months after the California Attorney General’s Office “finalized” the long-awaited CCPA regulations. The latest changes relate to offline notices, “Do Not Sell My Personal Information” opt-out requests, authorized agent requests, and children’s information, as discussed below.

As a reminder, the Department initially published its proposed regulations almost exactly a year ago, on October 12, 2019. It then devoted a large part of 2020 to collecting public comments, carefully considering them, and releasing several sets of modifications to its proposed regulations in February and March of 2020.

The Office of Administrative Law (OAL) then approved the modified regulations, and the regulations became final on August 14, 2020, as discussed in our August blog post. And, as we reported in greater detail last month, those Final Regulations included key deleted and new additional provisions, which had an immediate impact on businesses and their CCPA compliance obligations for the duration of 2020 and beyond.

Here are the latest key changes the AG’s office is now considering:

  1. Offline Collection Notice: Proposed section 999.306(b)(3) now offers examples of how businesses that collect personal information while interacting with their consumers offline can provide the notice of their right to opt-out of the sale of personal information through an offline method.
  2. Opt-Out Requests: Proposed section 999.315(h) now offers examples and further guidance on how a business’s methods for consumers submitting requests to opt-out should require only minimal steps. It also instructs businesses not to use confusing language, such as double negatives; not to collect more PI than necessary; and not to require consumers to click through or listen to reasons why they should not opt out (with some exceptions).
  3. Authorized Agent Requests: Proposed section 999.326(a) clarifies that businesses may require an authorized agent to provide proof and may require a consumer to verify their request.
  4. Children’s Information: Proposed section 999.332(a) includes a grammatical change, which clarifies that businesses subject to section 999.330 and/or 999.331 must include a description of the processes set forth in those sections in their privacy policies.

The AG’s deadline to submit written comments is October 28, 2020. A full text of the proposed changes can be found here. Businesses should carefully consider the latest set of modifications in deciding whether to comment and how these latest proposed changes impact their CCPA obligations moving forward. Meanwhile, we will continue to monitor and share with our readers any additional changes to the regulations and other CCPA-related developments.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Mintz - Privacy & Cybersecurity Viewpoints | Attorney Advertising

Written by:

Mintz - Privacy & Cybersecurity Viewpoints
Contact
more
less

Mintz - Privacy & Cybersecurity Viewpoints on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.