New California Privacy Initiative to Appear on November Ballot – Get Ready for CCPA 2.0

Mintz - Privacy & Cybersecurity Viewpoints

Mintz - Privacy & Cybersecurity Viewpoints

Just as businesses are gearing up for the start of enforcement of the California Consumer Privacy Act (“CCPA”), California cleared the way for the California Privacy Rights Act (“CPRA”). The CPRA is an initiative imposing greater privacy restrictions on businesses holding consumer data, to be voted on as part of California’s November 2020 ballot. The certification came following a Sacramento County Superior Court order compelling all 58 California counties to complete their verification of signatures in time so that the CPRA would be included on the 2020 ballot as well as an announcement by the Secretary of State affirming that it had received more than 623,212 valid signatures and that the CPRA was eligible for the 2020 ballot.

At its basic level, the CPRA strengthens the CCPA by creating new privacy rights, obligations, and enforcement mechanisms. Among these changes, the CPRA mandates the following:

  • Businesses must limit the use and disclosure of an expanded list of sensitive personal information (including data related to race, ethnicity, religion, personal communications, health information, and sexual orientation).
  • Businesses must give consumer notice that the consumer’s information may be sold and that the consumer has a right to opt-out of such sale.
  • Businesses will need to defend against private consumer litigation as the CPRA explicitly grants consumers a right to bring a private civil action for certain CPRA breaches.
  • Businesses will be subject to enforcement actions from, and regulations promulgated by, a newly created California Privacy Protection Agency.

The CPRA and the creation of the California Privacy Protection Agency would undoubtedly expand privacy regulations and enforcement actions. There has been little polling on the CPRA, but a survey commissioned by the Californians for Consumer Privacy (the sponsors of the ballot initiative) shows strong support for enhanced privacy legislation. While the CPRA, if passed, would not go into effect until January 1, 2023, businesses will want to keep a close watch on developments in order to have as much time as possible to prepare if the measure is approved. Watch this space.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Mintz - Privacy & Cybersecurity Viewpoints | Attorney Advertising

Written by:

Mintz - Privacy & Cybersecurity Viewpoints

Mintz - Privacy & Cybersecurity Viewpoints on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.