On July 8, the California Privacy Protection Agency (CPPA) released a Notice of Proposed Rulemaking, thereby formally beginning the rulemaking process to adopt regulations implementing California Privacy Rights Act (CPRA), which amends the California Consumer Privacy Act (CCPA). The CPPA’s proposed regulations accomplish three things:
- Update existing CCPA regulations to harmonize them with CPRA amendments to the CCPA;
- Operationalize new rights and concepts introduced by the CPRA to provide clarity and specificity to implement the law; and
- Reorganize and consolidate requirements set forth in the law to make the regulations easier to follow and understand.
What does this mean for businesses? The new regulations significantly expand the rights of control consumers have over the personal information that businesses hold about them. For example, California consumers now have:
- The right to delete the personal information that a business collects from them (with specified exceptions for operational and legal necessity);
- The right to know what personal information a business has collected about them, and how the business uses, sells, and shares that information;
- The right to opt-out of the sale or sharing of their personal information; and
- The right to limit a business’s use and disclosure of sensitive personal information about them for certain business purposes.
Businesses must provide consumers with certain disclosure about business practices as it relates to the collection and use of consumers’ personal information. Any collection, use, retention, and sharing of personal information must also be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected.
The proposed regulations will set forth clear requirements for how businesses should implement processes to comply with consumer requests and obtaining consumer consent to use personal information. The CPPA will hold a public hearing on August 24 and 25 for interested parties to present statements or arguments with respect to the proposed regulations. The new regulations are set to become effective on January 1, 2023, with enforcement to be effective on July 1, 2023.
For more information about how these regulations impact your business, contact us at info@mnklawyers.com.
This material is provided for informational purposes only. It is not intended to constitute legal advice, nor does it create a client-lawyer relationship between MNK Law and any recipient. Recipients should consult with counsel before taking any actions based on the information contained within this material.
