On November 3, 2020, Californians voted to pass Proposition 24, which modifies and expands the California Consumer Privacy Act (“CCPA”), which came into force on January 1 of this year. The new California Privacy Rights Act (“CPRA”), will supersede the CCPA effective January 1, 2023. Until that time the CCPA remains in effect.
As an initial matter, the CPRA changes the thresholds for businesses to be subject to the new law. To be a covered business under CPRA, one of the following must be present:
Other Key Changes
The 50+ page CPRA is an extensive and detailed piece of legislation. Changes to CCPA range from minor revisions and clarification, to expanding its coverage, creating a new oversight agency, introducing new concepts and enhancing individual private causes of actions.
The main changes to CCPA are:
When Does CPRA Come Into Force? The CCPA remains in effect until January 1, 2023, at which time the CPRA (and its regulations) will take over. Businesses that are subject to the CCPA now should be looking ahead and taking all the necessary precautionary measures, such as compiling a data inventory, reviewing consumer rights policies and procedures, data retention practices and vendor and third party agreements, to be well positioned for CPRA compliance.