Member Article

By: Jeffrey M. Dennis

The amended California Consumer Privacy Act (CCPA), sometimes referred to as the California Privacy Rights Act (CPRA) or Proposition 24, takes effect on January 1, 2023 – and introduces new consumer rights, while significantly increasing compliance pressures on companies who do business in California. With less than 60 days before the amended CCPA launches, the time for compliance is NOW.

What’s New?

The new CCPA provides consumers with several new rights, including the Right to Correction and the Right to Limit the Use and Disclosure of Sensitive Personal Information. It also expands the Right to Opt of the Sale of Personal Information to include information shared with third parties for cross-context behavioral advertising purposes – thereby expanding this right to be the Right to Opt Out of the Sale or Sharing of Personal Information.

For companies subject to the CCPA, several new burdens have been created under the revised law, including the following:

• Annual cybersecurity audits
• Regular risk assessments
• New contractual language requirements for service providers and contractors
• Requirements to recognize Global Privacy Controls (GPC)
• Data minimization

Also troubling is the creation of the California Privacy Protection Agency (the Agency), which has the authority under the CCPA to set wide-ranging regulations under the law, is responsible for education, but most importantly, has shared enforcement authority with the California Attorney General’s office. In other words, the Agency has a single focus – protecting the privacy rights of California residents. It is expected that enforcement will become more aggressive, especially in light of the recent Sephora enforcement action, which was brought by the California Attorney General.

Why Should I Care?

If you are a for-profit business that owns property in, has employees in or sells goods or services to residents in California and you have an annual revenue in excess of $25 million, you collect personal information of more than 100,000 California residents, or you derive at least 50% of your annual revenue from the sale of personal information – you will be subject to the amended CCPA. As such, your company’s privacy obligations are dramatically increasing.

For those who fully-complied with the original CCPA, further work is now required to reach the new levels of compliance requirements.  For those who did not fully-comply with the CCPA, the time is now for crossing the finish line (or starting your compliance journey).

Several factors weigh heavily in favor of compliance:

1. Civil penalties can be assessed up to $7,500 per each intentional violation.  As Sephora knows, these penalties can escalate quickly – Sephora was hit with a $1.2 million fine, in addition to other penalties;
2. Although only the Agency and the California Attorney General can assess these penalties, a private right of action still exists for consumers (or employees) whose data is breached; and
3. Importantly, the 30-day right to cure that existed under the original CCPA is gone – therefore, you will not be given an opportunity to correct your program if it is not in compliance.

What Do I Need To Do?

A wide variety of actions are required to become fully-compliant.  A partial list of these follows:

• Update your Privacy Policy;
• Generate required employee disclosures (since the employee exemption has been removed);
• Revise ancillary privacy forms that must accompany your Privacy Policy;
• Ensure that the required notice and opt-out links are posted on your homepage and that the links activate the necessary processes;
• Create new contract forms for service providers and contractors;
• Recognize Global Privacy Controls;
• Map your data (not required under the CCPA, but necessary to meet other compliance requirements);
• Establish or update your internal workflow for responding to consumer requests; and
• Train your employees.

Although this is not a comprehensive list, accomplishing these tasks will bring your company much closer to CCPA compliance.

It should also be noted that the Agency is still in the midst of finalizing a series of regulations - that most likely will not be implemented until early 2023. While this suggests that the compliance target may move, the vast majority of the CCPA compliance requirements are well-established and will not change. Companies should act now, and not wait for final regulations to be finalized. Any modifications required by the regulations will be small pivots, not massive swings in compliance requirements.

As always, our team stands ready to assist your business with all of its privacy compliance needs. Please do not hesitate to reach out to us with questions or concerns.

Jeffrey Dennis

This communication is not intended to create or constitute, nor does it create or constitute, an attorney-client or any other legal relationship. No statement in this communication constitutes legal advice nor should any communication herein be construed, relied upon, or interpreted as legal advice. This communication is for general information purposes only regarding recent legal developments of interest, and is not a substitute for legal counsel on any subject matter. No reader should act or refrain from acting on the basis of any information included herein without seeking appropriate legal advice on the particular facts and circumstances affecting that reader. For more information, visit www.buchalter.com.