On November 3, 2020, California voters passed Ballot Proposition 24,The California Privacy Rights Act of 2020 (“CPRA”), significantly amending the State’s recently effective California Consumer Privacy Act (“CCPA”), which is now known under the CPRA designation. Passage of CPRA means significant changes to CCPA, including the establishment of a new privacy enforcement agency, new definitions and usage limitations for sensitive data, and expanded breach liability. Businesses accessing and using the personal data of California residents are subject to CPRA and must become familiar with CPRA and its requirements.
CPRA establishes the California Privacy Protection Agency, a new agency which will have full power and jurisdiction to implement and enforce the CCPA, as amended by the CPRA, thereby transferring enforcement power from the state attorney general. The governor will appoint two individuals (including the chair) to the five-member board, with the remaining seats appointed by the attorney general, California Senate Rules Committee, and the Speaker of the California Assembly. The Consumer Privacy Fund will be created to fund the enforcement of CPRA, with initial state funding expected to be approximately $10 million.
CPRA creates an expanded category of personal information known as “sensitive data,” which includes government identifiers, account and login information, precise geolocation data, racial or ethnic origin, religious or philosophical beliefs, union membership, contents of mail, email and text messages, genetic data, and certain sexual orientation, health and biometric information. “Sensitive data” will be subject to additional protections under CPRA.
One change that will be favorably received by businesses subject to CPRA is the extension of CCPA’s existing employee exception and business-to-business exception to January 1, 2023. CPRA also provides for better protection for businesses against liability for violations of the law by third parties.
Some industry experts believe that these, and other changes to CCPA, will more closely align CPRA with the European Union’s GDPR, potentially facilitating the ability of California businesses to receive personal data from EU residents. Other industry leaders interpret the passage of CPRA as indicative of a continuing interest by the public (if not by elected officials) to see federal privacy legislation enacted. However, the opportunity for federal legislation in 2021 remains elusive.
CPRA takes effect in January 2023 but will include a "look back" to January 2022 for enforcement purposes. Specific changes to CCPA and the impact on individuals and business are subject to regulations which have yet to be developed. Businesses subject to CPRA will need to monitor the proposed regulations in order to modify their existing privacy practices well before the effective and look back dates.
Watch for additional updates as we learn more about CPRA and its impact.
Opinions and conclusions in this post are solely those of the author unless otherwise indicated. The information contained in this blog is general in nature and is not offered and cannot be considered as legal advice for any particular situation. The author has provided the links referenced above for information purposes only and by doing so, does not adopt or incorporate the contents. Any federal tax advice provided in this communication is not intended or written by the author to be used, and cannot be used by the recipient, for the purpose of avoiding penalties which may be imposed on the recipient by the IRS. Please contact the author if you would like to receive written advice in a format which complies with IRS rules and may be relied upon to avoid penalties.
[View source.]
