Nicholas Farnsworth

Managing Associate

Boston


Read full biography at www.orrick.com

Privacy and cybersecurity underpins the innovative strategies of businesses across all sectors and introduces both legal and operational concerns. As a Managing Associate in Orrick's internationally recognized Cyber, Privacy & Data Innovation team, Nick Farnsworth advises clients on a broad range of privacy and cybersecurity matters, including compliance, risk management, government investigations and incident response.

Nick's practice focuses on guiding clients through the patchwork of state, federal and international privacy and cybersecurity laws. His practice includes advising clients on proposed and effective state privacy and cybersecurity laws, such as the California Consumer Privacy Act (CCPA), Section 5 of the Federal Trade Commission Act (FTC Act), biometric privacy laws, such as the Illinois Biometric Information Privacy Act (BIPA), the Children's Online Privacy Protection Act (COPPA), the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the Telephone Consumer Protection Act (TCPA), CAN-SPAM, and state breach notification laws. Nick also advises clients on the impact of international laws from a U.S. perspective, including the European Union General Data Protection Regulation (GDPR).

Nick assists clients from a broad range of industries and sectors in assessing their current privacy and cybersecurity practices. He regularly assists clients in developing global privacy and cybersecurity programs to practically implement the principles and obligations underlying various legal regimes, as well as assessing proposed marketing/advertising, product and business strategies from a privacy and cybersecurity perspective. Nick also advises clients on privacy and cybersecurity government investigations and the assessment of suspected incidents/breaches and any associated notification obligations, as well as the privacy and cybersecurity risks associated with proposed transactions and the development and deployment of advanced technologies, including adtech, artificial intelligence and machine learning, automated and connected vehicles, and biometric tools.

In addition, Nick has an active pro bono practice, which has included representing clients in immigration and innocence matters and assisting small businesses with their legal needs.

To make the California Consumer Privacy Act (CCPA) more accessible, Nick was a member of the team that developed Orrick's CCPA Readiness Assessment Tool. The tool provides companies an opportunity to test their preparedness for compliance with the CCPA as a first step to constructing their strategic compliance roadmap.

Prior to law school, Nick worked in the defense industry, which spurred his interest in innovative, cutting-edge technology and helps him better understand how to integrate legal solutions with business practicality in order to address the needs of his clients. 

Posts by: Nicholas Farnsworth

Final CCPA Regulations Effective Immediately With Last-Minute Revisions

On August 14, 2020, the California Office of Administrative Law (“OAL”) approved the final implementing regulations pursuant to the California Consumer Privacy Act of 2018 (“CCPA”). This final and approved version of the CCPA regulations went into effect immediately and contains a last round of revisions to language that has been refined across several iterative drafts.[1] While the majority of the changes are grammatical in nature and will have no effect on CCPA compliance requirements, there were a few substantive changes that could impact certain businesses. READ MORE

CCPA 2.0 Makes the Ballot! What’s Next for the California Privacy Rights Act?

On June 25, 2020, Californians for Consumer Privacy announced the California Privacy Rights Act of 2020 (“CPRA”) officially qualified for California’s November 2020 ballot. We previously provided guidance here about what the CPRA is and whether the CPRA will become law, but we have been receiving a lot of questions about the timeline associated with the recently qualified ballot initiative. If the CPRA becomes law, most of its provisions will become effective on January 1, 2023, but certain provisions would go into effect as soon as late this year. Below is a summary of the key dates to keep in mind for the CPRA:

June 25, 2020

CPRA Qualification & No Possibility for Withdrawal

On June 25, 2020, one day after the California Secretary of State confirmed the CPRA received enough valid signatures, the CPRA was certified for the November 3, 2020 Statewide General Election Ballot as Proposition 24.

As outlined in guidance by the California Secretary of State, the Californians for Consumer Privacy no longer have the right to withdraw the CPRA. This means the California Legislature will not be able to negotiate amendments to the California Consumer Privacy Act of 2018 (“CCPA”) in exchange for withdrawal of the initiative (which is what occurred to make the CCPA law). In fact, a proposed bill that would amend the CCPA to extend the employee and B2B exceptions to January 1, 2022, now includes language that it shall only become operative if voters do not approve the CPRA.


On July 1, 2020, the California Attorney General was statutorily permitted to begin enforcing the CCPA. The CCPA requirements remain in flux in part because the CCPA regulations have yet to be approved and finalized.

July 1, 2020

CCPA Enforcement Date


November 3, 2020

California Statewide General Election

The CPRA will be set to become law if it is approved by a majority vote at the Statewide General Election on November 3, 2020.

The Californians for Consumer Privacy currently predict 88 percent of California voters would vote YES to support a ballot measure expanding privacy protections for personal information, like the CPRA. As a result, there appears to be sufficient support for the CPRA to become law.


In accordance with Article II, § 10(a) of the California Constitution, a ballot initiative that is approved by a majority vote at the statewide general election takes effect the fifth day after the Secretary of State certifies the election results, unless the initiative measure provides otherwise.

On the fifth day after certification, the following provisions of the CPRA become law in accordance with Section 31(b) of the CPRA:

  • Section 1798.145(m)-(n): The extensions of the personnel/employee exception and B2B exception to January 1, 2023.
  • Section 1798.160: The creation of a “Consumer Privacy Fund.”
  • Section 1798.185: The direction for the Attorney General to adopt regulations and the mechanism to transfer regulatory authority to the new privacy agency.
  • Section 1798.199.10-40: The establishment of the California Privacy Protection Agency, the new privacy agency vested with full administrative power, authority and jurisdiction to implement and enforce the CCPA, as amended by the CPRA.
  • Section 1798.199.95: The designation of funds for the new California Privacy Protection Agency.

Likely Mid-December 2020

Preliminary CPRA

Effective Date


July 1, 2021

Transfer of Regulatory Authority to New Privacy Agency

In accordance with Section 21 of the CPRA, beginning the later of July 1, 2021, or six months after the new agency provides notice to the California Attorney General that it is prepared to begin rulemaking activity, the authority assigned to the California Attorney General to adopt regulations under the CPRA shall be exercised by the new California Privacy Protection Agency.

In accordance with Section 31(a) of the CPRA, the obligations under the CPRA, with the exception of the right of access, will only apply to personal information collected by the business on or after January 1, 2022.  

January 1, 2022 Look-Back Period

 


 

July 1, 2022 Deadline for Adopting Final Regulations

 

In accordance with Section 21 of the CPRA, the final regulations under the CPRA must be adopted by July 1, 2022.

In accordance with Section 31(a) of the CPRA, the remainder of the CPRA becomes operative on January 1, 2023, including the highlights from the CPRA we describe in more detail here:

  • Revision and expansion of the scope of covered “businesses” under Cal. Civ. Code § 1798.140(d).
  • Addition of a new category of personal information“sensitive personal information.”
  • Expansion of the requirements for the notice at collection.
  • Adoption of an explicit, overarching purpose-limitation obligation.
  • Addition of new consumer rights and revision of existing obligations.
  • Expansion of contracting requirements with third parties, service providers and “contractors.”
  • Modification of statutory exceptions.
  • Imposition of “reasonable security” obligations.
  • Expansion of the breach private right of action.
  • Revision of fine structure for violations involving children’s information.

January 1, 2023

Full Operative Date


July 1, 2023 Enforcement Date

In accordance with Section 21 of the CPRA, civil and administrative enforcement of the obligations added by the CPRA cannot begin until July 1, 2023, and can only apply to violations occurring on or after that date.

Conclusion

The CPRA will be on the ballot for the November 3 California Statewide General Election, and it appears to have garnered sufficient statewide support to become law. However, the CPRA includes a fairly reasonable two-year ramp-up period for businesses to adjust their practices to comply with the new and revised obligations. As a result, companies do not need to panic and scramble to address CPRA obligations immediately. Instead, we recommend a measured approach to assess the gap between a business’s current CCPA compliance program and develop a roadmap for addressing the obligations in a way that minimizes the strain on organizational resources and friction with other business objectives.

Legislative Update: Privacy Bills Not Immune to COVID-19 As Legislative Efforts Persist and Evolve

Today, we are all facing a public health crisis unlike any other we have seen in our lifetime. In addition to serious consequences to global health, the COVID-19 pandemic has created significant disruption in the legal system and privacy law initiatives have not been immune to the virus’s impact. With many state legislatures nearing or at the end of legislative sessions taken over by pandemic priorities, state privacy bill initiatives across the country are grinding to a halt. However, some lawmakers are pushing forward with targeted proposals to protect individual privacy in the face of COVID-19 and some states, particularly California, continue public and private efforts to bolster privacy in their jurisdiction. Below is a summary of the 2020 privacy legislative efforts to date and the impact COVID-19 has had on their progress. READ MORE

Wait…CCPA 2.0? What Is the California Privacy Rights Act of 2020 and Will It Become Law?

On May 4, 2020, Californians for Consumer Privacy announced that it submitted over 900,000 signatures to qualify the California Privacy Rights Act of 2020 (“CPRA”) for California’s November 2020 ballot. With the California Consumer Privacy Act of 2018 (“CCPA”) set to become enforceable on July 1, 2020, this new ballot initiative has left many wondering what the CPRA is and whether the CPRA will become law. We explore these questions further below.

READ MORE

Tale of Two Acts: Washington Facial Recognition Law Succeeds, Privacy Act Falters

On Tuesday, Washington Governor Jay Inslee signed into law legal restrictions on the use of facial recognition by public agencies (SB 6280), while the Washington Legislature previously reached an impasse on the proposed Washington Privacy Act (SB 6281) due to a few big ticket items, particularly whether the Act would be enforceable via a private right of action for Washington residents. READ MORE

California AG Releases More Modifications to CCPA Regulations

On March 11, 2020, the California Attorney General, Xavier Becerra, (“California AG”) released a second set of modifications to the proposed regulations pursuant to the California Consumer Privacy Act of 2018 (“CCPA”). These recent modifications reflect some minor changes and clarifications from the first set of modifications to the proposed regulations (published on February 10, 2020).[1]

READ MORE

California Attorney General Releases Updated Drafts of Proposed CCPA Regulations

On February 7 and again on February 10, 2020, the California Attorney General Xavier Becerra released an updated draft of proposed regulations pursuant to the California Consumer Privacy Act of 2018 (“CCPA”).  The updated drafts feature significant changes, clarifications and reversals of policy from the original proposal.

The updated draft regulations—available here (clean) and here (redline to the original October 2019 Draft)—reflect input gathered during the public comment period and series of public hearings which concluded on December 6, 2019. The first draft of the proposed regulations, the public comments and the transcripts and audio of the public hearings are available on the Attorney General’s CCPA webpage.  The Attorney General also updated the online cache of documents and other information relied upon in preparing the revised draft regulations here.

READ MORE

The CCPA Is in Effect and It Is Not Too Late to Get Started in 2020

Happy New Year! At long last, the California Consumer Privacy Act of 2018 (“CCPA”) went into effect yesterday, January 1, 2020. For those who have not yet heard, the CCPA establishes a comprehensive legal framework to govern the collection and use of personal information, both online and offline, and provides unprecedented privacy rights to California consumers, in effect becoming the de facto national standard for U.S. privacy law. The law introduces new legal risks and considerations for companies that collect information from California consumers, due to the law’s expansive scope, broad definition of personal information, increased disclosure obligations, enhanced consumer rights, potential for statutory fines and, in the event of a security incident, the potential for consumer class action litigation. READ MORE

California Governor Signs CCPA and Breach Notification Statute Amendments into Law

With the January 1, 2020 effective date of the California Consumer Privacy Act (the “CCPA”) rapidly approaching, all eyes have been on the California legislature’s consideration of a robust suite of amendments that would clarify ambiguities and address discrepancies underlying the prominent privacy statute. On October 11, 2019, six CCPA amendments were signed into law by the California Governor, as well as an amendment to the state’s breach notification statute. The rest of the CCPA amendments have either failed or will have to wait until next year for further consideration.

READ MORE

Up for Interpretation: Proposed CCPA AG Regulations Open for Public Comment

On October 10, 2019, the California Attorney General added to the complexity of the California Consumer Privacy Act of 2018 (“CCPA”) by releasing long-awaited proposed regulations that provide guidance on various elements of the CCPA. The text of the proposed regulations is available here and the California Attorney General has made other documents and information relating to the proposed regulations available here. The comment period for the proposed regulations will close on December 6, 2019. Interested parties may review and provide written comments addressing the proposed regulations prior to that date or attend one of four scheduled public hearings on the proposed regulations to be held on December 2-5, 2019. READ MORE