Overview, California Privacy Rights Act, Compliance Requirements

Key Changes to the CCPA

The CPRA amends the rights granted to individuals and the obligations imposed on covered businesses. We highlight some of those changes below.

Definition of Covered Businesses

Whereas the CCPA currently applies to companies that annually buy, receive, sell or share the personal information of more than 50,000 consumers or households, among other threshold criteria, the CPRA increases this threshold to 100,000 consumers or households.

Covered businesses could also include businesses that derive 50% or more of their annual revenue from sharing personal information (and not just the sale of such information as set forth in the CCPA). The CPRA may operate to clarify the uncertainty surrounding the CCPA’s definition of sale, which arguably already included sharing the information by expressly adding the terms “share,” “shared” or “sharing” which are defined as making available, or otherwise communicating, a consumer’s personal information by the business to a third party for cross-context behavioral advertising or targeting consumer advertising based on consumer activities. Cross-context behavioral advertising is defined narrowly. Therefore, communicating a consumer’s personal information to, for example, a service provider, to enable it to provide marketing and advertising services (excluding cross-context behavioral advertising services) such as serving non-personalized advertisements—which are based on the consumer’s personal information derived from their current interaction with the business—would count as a permitted business purpose.

Sensitive Personal Information

The CPRA introduces a new category of regulated information, “sensitive personal information,” which includes government identification; login information; credit and debit card numbers in combination with any required access code; precise geolocation; racial or ethnic origin; religious or philosophical beliefs; contents of mail, email and texts; genetic data; uniquely identifying biometric information; healthcare data; and information pertaining to sexual activities and preferences. The CPRA also grants consumers more control over a covered business’ use of this category of information by, for instance, directing a covered business to limit its use of sensitive personal information to specifically permitted purposes.

New and Modified Consumer Rights

The CPRA modifies existing rights under the CCPA and creates new rights for consumers. The CPRA amends a consumer’s right to request deletion of personal information. Whereas the CCPA requires covered businesses to only inform service providers about deletion requests, under the CPRA, businesses must notify all third parties to whom the business has sold or shared a consumer’s personal information of a deletion request.

The CPRA also creates new consumer rights. These include a consumer’s right to correct inaccurate personal information; the right to restrict the processing of sensitive personal information; and the right to opt out of the sharing of personal information for cross-context behavioral advertising.

Expanded Pre-Collection Disclosure Obligations

The CCPA already requires certain consumer notices regarding the collection and use of their personal information. The CPRA also requires disclosure of the length of time each category of personal information will be retained.

Reasonable Information Security

The CPRA makes clear that covered businesses are required to implement and maintain reasonable security practices and procedures.

Audit Requirements

Unlike the CCPA, the CPRA imposes audit and risk assessment requirements. If the processing activities of a covered business present significant risk to a consumer’s privacy or security, the business is required to perform a cybersecurity audit on an annual basis. The business must also submit to the California Privacy Protection Agency (CPPA), on a regular basis, an assessment with respect to the covered business’ processing of personal information which identifies and weighs the benefits resulting from the processing against the potential risks to the rights of the consumer.

Service Provider Requirements

The CPRA specifies certain restrictions that must be incorporated in a written contract with a service provider including, but not limited to, restrictions on selling or sharing, retaining, using or disclosing personal information other than for the purpose specified in the written agreement or by the business-service provider relationship. The CPRA also requires service providers to cooperate with and assist a covered business in responding to verifiable consumer requests.

Enforcement

The CPRA establishes a new enforcement agency, the CPPA, which is charged with administering, implementing and enforcing the provisions of the CCPA. If the CPPA determines that a violation has occurred, it may require the violator to cease and desist the violation and/or pay an administrative fine of up to $2,500 for each violation or up to $7,500 for each intentional violation and each violation involving the personal information of minor consumers.