CCPA

CA Businesses Poised to Have CCPA Compliance Deadline Extended for B2B and Employee Data

The California legislature has passed AB 1281 to the Governor’s desk for signature and, given the absence of legislative opposition, it appears the bill is now well positioned to be signed into law.  AB-1281 extends by one year the expiration date of the business-to-business (“B2B”) and employee-related exemptions provided for under the California Consumer Privacy Act (“CCPA”) (previously discussed here).  If signed into law, it will give California businesses at least one more year to work on folding employee and B2B data into their existing CCPA compliance programs, a welcome reprieve for California employers facing a resurgence of coronavirus cases in workplaces around the State.  READ MORE

CCPA 2.0 Makes the Ballot! What’s Next for the California Privacy Rights Act?

On June 25, 2020, Californians for Consumer Privacy announced the California Privacy Rights Act of 2020 (“CPRA”) officially qualified for California’s November 2020 ballot. We previously provided guidance here about what the CPRA is and whether the CPRA will become law, but we have been receiving a lot of questions about the timeline associated with the recently qualified ballot initiative. If the CPRA becomes law, most of its provisions will become effective on January 1, 2023, but certain provisions would go into effect as soon as late this year. Below is a summary of the key dates to keep in mind for the CPRA:

June 25, 2020

CPRA Qualification & No Possibility for Withdrawal

On June 25, 2020, one day after the California Secretary of State confirmed the CPRA received enough valid signatures, the CPRA was certified for the November 3, 2020 Statewide General Election Ballot as Proposition 24.

As outlined in guidance by the California Secretary of State, the Californians for Consumer Privacy no longer have the right to withdraw the CPRA. This means the California Legislature will not be able to negotiate amendments to the California Consumer Privacy Act of 2018 (“CCPA”) in exchange for withdrawal of the initiative (which is what occurred to make the CCPA law). In fact, a proposed bill that would amend the CCPA to extend the employee and B2B exceptions to January 1, 2022, now includes language that it shall only become operative if voters do not approve the CPRA.


On July 1, 2020, the California Attorney General was statutorily permitted to begin enforcing the CCPA. The CCPA requirements remain in flux in part because the CCPA regulations have yet to be approved and finalized.

July 1, 2020

CCPA Enforcement Date


November 3, 2020

California Statewide General Election

The CPRA will be set to become law if it is approved by a majority vote at the Statewide General Election on November 3, 2020.

The Californians for Consumer Privacy currently predict 88 percent of California voters would vote YES to support a ballot measure expanding privacy protections for personal information, like the CPRA. As a result, there appears to be sufficient support for the CPRA to become law.


In accordance with Article II, § 10(a) of the California Constitution, a ballot initiative that is approved by a majority vote at the statewide general election takes effect the fifth day after the Secretary of State certifies the election results, unless the initiative measure provides otherwise.

On the fifth day after certification, the following provisions of the CPRA become law in accordance with Section 31(b) of the CPRA:

  • Section 1798.145(m)-(n): The extensions of the personnel/employee exception and B2B exception to January 1, 2023.
  • Section 1798.160: The creation of a “Consumer Privacy Fund.”
  • Section 1798.185: The direction for the Attorney General to adopt regulations and the mechanism to transfer regulatory authority to the new privacy agency.
  • Section 1798.199.10-40: The establishment of the California Privacy Protection Agency, the new privacy agency vested with full administrative power, authority and jurisdiction to implement and enforce the CCPA, as amended by the CPRA.
  • Section 1798.199.95: The designation of funds for the new California Privacy Protection Agency.

Likely Mid-December 2020

Preliminary CPRA

Effective Date


July 1, 2021

Transfer of Regulatory Authority to New Privacy Agency

In accordance with Section 21 of the CPRA, beginning the later of July 1, 2021, or six months after the new agency provides notice to the California Attorney General that it is prepared to begin rulemaking activity, the authority assigned to the California Attorney General to adopt regulations under the CPRA shall be exercised by the new California Privacy Protection Agency.

In accordance with Section 31(a) of the CPRA, the obligations under the CPRA, with the exception of the right of access, will only apply to personal information collected by the business on or after January 1, 2022.  

January 1, 2022 Look-Back Period

 


 

July 1, 2022 Deadline for Adopting Final Regulations

 

In accordance with Section 21 of the CPRA, the final regulations under the CPRA must be adopted by July 1, 2022.

In accordance with Section 31(a) of the CPRA, the remainder of the CPRA becomes operative on January 1, 2023, including the highlights from the CPRA we describe in more detail here:

  • Revision and expansion of the scope of covered “businesses” under Cal. Civ. Code § 1798.140(d).
  • Addition of a new category of personal information“sensitive personal information.”
  • Expansion of the requirements for the notice at collection.
  • Adoption of an explicit, overarching purpose-limitation obligation.
  • Addition of new consumer rights and revision of existing obligations.
  • Expansion of contracting requirements with third parties, service providers and “contractors.”
  • Modification of statutory exceptions.
  • Imposition of “reasonable security” obligations.
  • Expansion of the breach private right of action.
  • Revision of fine structure for violations involving children’s information.

January 1, 2023

Full Operative Date


July 1, 2023 Enforcement Date

In accordance with Section 21 of the CPRA, civil and administrative enforcement of the obligations added by the CPRA cannot begin until July 1, 2023, and can only apply to violations occurring on or after that date.

Conclusion

The CPRA will be on the ballot for the November 3 California Statewide General Election, and it appears to have garnered sufficient statewide support to become law. However, the CPRA includes a fairly reasonable two-year ramp-up period for businesses to adjust their practices to comply with the new and revised obligations. As a result, companies do not need to panic and scramble to address CPRA obligations immediately. Instead, we recommend a measured approach to assess the gap between a business’s current CCPA compliance program and develop a roadmap for addressing the obligations in a way that minimizes the strain on organizational resources and friction with other business objectives.

Legislative Update: Privacy Bills Not Immune to COVID-19 As Legislative Efforts Persist and Evolve

Today, we are all facing a public health crisis unlike any other we have seen in our lifetime. In addition to serious consequences to global health, the COVID-19 pandemic has created significant disruption in the legal system and privacy law initiatives have not been immune to the virus’s impact. With many state legislatures nearing or at the end of legislative sessions taken over by pandemic priorities, state privacy bill initiatives across the country are grinding to a halt. However, some lawmakers are pushing forward with targeted proposals to protect individual privacy in the face of COVID-19 and some states, particularly California, continue public and private efforts to bolster privacy in their jurisdiction. Below is a summary of the 2020 privacy legislative efforts to date and the impact COVID-19 has had on their progress. READ MORE

The CCPA Is in Effect and It Is Not Too Late to Get Started in 2020

Happy New Year! At long last, the California Consumer Privacy Act of 2018 (“CCPA”) went into effect yesterday, January 1, 2020. For those who have not yet heard, the CCPA establishes a comprehensive legal framework to govern the collection and use of personal information, both online and offline, and provides unprecedented privacy rights to California consumers, in effect becoming the de facto national standard for U.S. privacy law. The law introduces new legal risks and considerations for companies that collect information from California consumers, due to the law’s expansive scope, broad definition of personal information, increased disclosure obligations, enhanced consumer rights, potential for statutory fines and, in the event of a security incident, the potential for consumer class action litigation. READ MORE

Orrick Webinar: Last-Minute Amendments – Changes to California’s New Privacy Law Ahead of the Effective Date

Webinar | October 30, 2019

Download Powerpoint Presentation

Please join Heather Sussman, Emily Tabatabai, and Nick Farnsworth for the Cyber, Privacy & Data Innovation practice’s webinar “Last-Minute Amendments- Changes to California’s New Privacy Law Ahead of the Effective Date.”

READ MORE

Orrick Webinar: Defining “Reasonable” Security Under California’s New Privacy Law

Webinar | September 26, 2019

Download Powerpoint Presentation

Please join Michelle Visser and Nicole Gelsomini for the Cyber, Privacy & Data Innovation practice’s webinar “Defining ‘Reasonable’ Security Under California’s New Privacy Law.” READ MORE

Orrick Webinar: Spotlight on EdTech – How the New California and Nevada Privacy Laws Will Impact Data in EdTech

Webinar | August 27, 2019

Download Powerpoint Presentation

Please join Emily Tabatabai and Sulina Gabale for the Cyber, Privacy & Data Innovation practice’s webinar “Spotlight on EdTech – How the New California and Nevada Privacy Laws Will Impact Data in EdTech.”
READ MORE

Orrick Webinar: Spotlight on Fintech – How the New California and Nevada Privacy Laws Will Impact Data in Fintech

Webinar | July 30.2019

Download Powerpoint Presentation

Please join Heather Sussman, Barrie VanBrackle and David Curtis for the Cyber, Privacy & Data Innovation practice’s webinar “Spotlight on Fintech – How the New California and Nevada Privacy Laws Will Impact Data in Fintech.”

READ MORE

Orrick Webinar: New U.S. Privacy Laws – What Companies Need to Know

Webinar (recording available) | June.25.2019

Click to Play

Download Powerpoint Presentation

Please join Heather Sussman and Matthew Coleman for the Cyber, Privacy & Data Innovation practice’s webinar “California’s and Nevada’s New Privacy Laws – What Companies Need to Know.”

California was the first U.S. state to enact a sweeping new privacy law, known as the CCPA, with an effective date of January 2020. Nevada has now enacted a scaled-down version of the CCPA that is slated to take effect even sooner – as early as October 2019.
READ MORE