Updated Attorney General Regulations to the CCPA – A Series

Mintz - Privacy & Cybersecurity Viewpoints
Contact

Mintz - Privacy & Cybersecurity Viewpoints

The revised draft regulations to the California Consumer Privacy Act were issued by the California Attorney General’s office on February 7, and then modified on February 10. These amendments are open for public comment under Tuesday, February 25, 2020 at 5 pm PST.

Starting tomorrow, we will update our October 2019 series of analyses of the various provisions of the draft regulations and operational impacts. There are some key takeaways that will be examined in further detail in each installment of our series.

Notice Requirements Updated and Added

The revised regulations make clear that there are different notices required at different times, including a privacy policy, a notice at collection of the personal information, and a notice of right to opt-in if the business sells personal information. Illustrative examples have been added and should be reviewed in the context of your business and information collection practices.

Requirements regarding accessibility have been further defined. You will need to ensure that all notices are “reasonably accessible to consumers with disabilities” and for notices provided online, the revision specifies that this means that “at a minimum … the business shall follow generally recognized industry standards, such as the Web Content Accessibility Guidelines, version 2.1 of June 5, 2018, from the World Wide Consortium, incorporated herein by reference. In other contexts, the business shall provide information on how a consumer with a disability may access the notice in an alternative format.”

Service Providers

The revisions make clear that a service provider may use a business’ personal information “for internal use … to build or improve the quality of its services, provided that the use does not include building or modifying household or consumer profiles, or cleaning or augmenting data acquired from another source.” This is a significant improvement for service providers and any amendments to contracts entered into before January 1, 2020 should be reviewed again to ensure that service providers are able to avail themselves of this clarification. Uses of personal information beyond obtained in the course of providing services should be analyzed to ensure that internal use would not include activities in the proviso for the service provider’s own use and not in the course of services rendered to the business.

Third Parties

The revised regulations no longer require that a third party that purchases personal information to contact the consumer directly to provide notice and an opt-out, or to contact the source and confirm that the source provided the required notice with attestations.

Nature of Personal Information

The revisions clarify that whether information is actually “personal information” for purposes of the CCPA will depend upon how the business maintains and uses the information. New Section 999.302 says, for example, “if a business collects the IP addresses of visitors to its website but does not link the IP address to any particular consumer or household, and could not reasonably link the IP address with a particular consumer or household, then the IP address would not be “personal information.”

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Mintz - Privacy & Cybersecurity Viewpoints | Attorney Advertising

Written by:

Mintz - Privacy & Cybersecurity Viewpoints
Contact
more
less

Mintz - Privacy & Cybersecurity Viewpoints on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide