The California Privacy Rights Act (CPRA) will take effect on January 1, 2023. The CPRA imposes additional requirements on companies that do business in California, expanding upon its predecessor in privacy: the California Consumer Privacy Act (CCPA).
With the rules and regulations governing consumer data privacy soon subject to change, it is the responsibility of businesses to stay informed and implement those modifications necessary to ensure compliance with the CCPA and CPRA.
Below, we have provided a brief overview of the CCPA and the CPRA, which we hope will answer questions such as:
What is the California Consumer Privacy Act (CCPA)?
The CCPA, which became effective on January 1, 2022, expanded privacy rights for California residents, providing these consumers with greater control over the use and dissemination of their personal information. In turn, California businesses covered by the Act were met with additional restrictions and requirements, forcing these companies to increase their transparency with respect to data usage and transmission, and implement the mechanisms and processes necessary to facilitate consumer management of person information.
What Businesses are Covered by the CCPA?
The CCPA applies to all “for profit” businesses that do business in California and:
What Notices are Requited by the CCPA?
Businesses must provide a “notice at collection” that explains what types of personal information the business will collect and how that information will be used.
If a business sells consumers’ personal information, the “notice at collection” must also include a “do not sell link” that will allow the user to opt–out and prevent the sale of their data.
What Rights do Consumers Have Under the CCPA?
The CCPA had a significant impact on the data privacy landscape within California, providing consumers with many new privacy rights including:
Opt-Out Requests Under the CCPA and Exceptions
Subject to certain exceptions, California consumers have the right to opt–out of the sale of their personal information. Once a consumer has submitted an “opt-out request”, the recipientbusinesses must stop selling that individual’s personal information.
The exceptions that exist to this general rule are found in Civil Code section 1798.145 and include where such information is necessary for:
Businesses were also permitted to use personal information subject to an opt-out notice where:
Expiration of Exemptions for B2B and Employment-Related Data
Previously, information collected by a business from its job applicants, employees, owners, directors, or officers was exempted from the restrictions of CCPA where such information was used by the business within the context of that person’s role within the business. B2B (business-to-business) data was also exempted under the CCPA. These exemptions are set to expire as of January 1, 2023 and, the legislature has taken no action to extend them.
Thus, beginning January 1, 2023, the CCPA’s restrictions and regulations will apply to B2B and employment data.
For businesses that are currently in compliance with the CCPA, you will need to review your current policies and make changes as needed to your privacy disclosures to include employment or B2B data as well as to ensure that you are in compliance with the CPRA’s amendments.
What is the California Privacy Rights Act (CPRA)?
The California Privacy Rights Act (CPRA), also known as Proposition 24 or “CCPA 2.0,” was a ballot initiative approved by the voters on November 3, 2020, that will go into effect on January 1, 2023.
The CPRA makes significant changes to the CCPA.
As referenced above, the CPRA narrows the reach of its restrictions. Previously, the restrictions and regulations imposed by the CCPA covered businesses that buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices – the CPRA increases the number of California residents who must be effected by such activities to 100,000.
On the contrary, the CPRA expands consumer privacy rights. In addition to the rights granted by the CCPA, the CPRA gives consumers the right to:
The CPRA amendments include additional protections for “sensitive personal information” including:
The CPRA will require businesses to include links on their websites that allow consumers to choose to “limit the use of [their] sensitive personal information” and direct the business to “not sell or share [their] personal information” which will allow the consumer to opt-out of the selling or sharing of their sensitive personal information.
The CPRA also requires businesses to keep consumers informed with respect to how long the business intends to retain personal information and prohibits businesses from retaining personal information longer than the stated time.
Contractors, service providers, and third parties contracting with businesses covered by the CCPA and CPRA will now be subject to the same privacy requirements as these businesses.
Enforcement of the CCPA and the CPRA
Although the California Attorney General’s Office, city attorneys, and district attorneys still have jurisdiction to enforce the provisions of the CCPA/CPRA, the CPRA also created a new enforcement agency called the California Privacy Protection Agency which is authorized to enforce the CPRA and impose penalties.
CPRA no longer allows for the 30-day notice period granted by the CCPA to businesses in violation of it requirements. Under the CPRA, if a business violates either of these privacy acts, it can immediately be fined:
CCPA/ CPRA Checklist for Businesses
Does the CCPA apply to your business?
If it does, and your business is already in compliance with the CCPA, you may need to review your current policies to identify any changes that must be made before January 1, 2023, to ensure compliance with the changing requirements under CPRA, and expiration of those CCPA exemptions described.
If the CCPA did not apply to your business before, but does now, you should take the following steps to ensure compliance:
Please feel free to contact Fauver, Large, Archbald & Spray with questions about the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), the changes that will go into effect on January 1, 2023, and how they will affect your business.
We also remain available to help you with all your general business, corporate, estate, and tax planning needs.
DISCLAIMER: This publication is one of a series of business, real estate, employment, estate planning, and tax bulletins prepared by the attorneys at Fauver, Large, Archbald & Spray, LLP. This publication is not exhaustive, nor is it legal advice. You should discuss your uniquesituation with us or with your attorney. Our legal representation is only undertaken through a written engagement letter and not by the distribution or use of this publication.