What Should We Do About the Draft CPRA Regulations?: Contracts

Sheppard Mullin Richter & Hampton LLP

Sheppard Mullin Richter & Hampton LLP

In this third post of our ongoing series, we examine key takeaways for companies in light of the recently released draft CPRA regulations. Today’s focus is on contractual requirements. (Visit here for information about collection and notice under the draft regulations, and here for information about choice.)

The contractual requirements in the draft regulations do not mirror the statute and add entirely new obligations. For example, the draft regulations prescribe a new, five-day time period in which a service provider, contractor, or third party must notify the business if they determine they can no longer comply with the CPRA’s requirements. The draft regulations also require contracts with service providers to identify the specific business purposes and services for which personal information will be processed and prohibit generic descriptions of such purposes, such as referencing the entire contract generally.

The draft regulations state that failure to meet the prescriptive requirements means that the recipient is not a service provider or contractor under the CCPA. This means that any such transfer would be deemed a “share” subject to the right to opt out of sharing. Businesses must also conduct due diligence on service providers, contractors, and third parties to take advantage of the CPRA statute’s liability shield for compliance failures of the service provider, etc. without the business’s knowledge.

Putting it into practice. While the draft regulations may undergo many updates between now and CPRA’s January 1, 2023 effective date, there are certain things companies can do today. This includes analyzing these new requirements for contracts and analyzing existing service provider relationships to identify possible gaps.

[View source.]

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Sheppard Mullin Richter & Hampton LLP | Attorney Advertising

Written by:

Sheppard Mullin Richter & Hampton LLP

Sheppard Mullin Richter & Hampton LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.