|
June 25, 2020
CPRA Qualification & No Possibility for Withdrawal
|
On June 25, 2020, one day after the California Secretary of State confirmed the CPRA received enough valid signatures, the CPRA was certified for the November 3, 2020 Statewide General Election Ballot as Proposition 24.
As outlined in guidance by the California Secretary of State, the Californians for Consumer Privacy no longer have the right to withdraw the CPRA. This means the California Legislature will not be able to negotiate amendments to the California Consumer Privacy Act of 2018 (“CCPA”) in exchange for withdrawal of the initiative (which is what occurred to make the CCPA law). In fact, a proposed bill that would amend the CCPA to extend the employee and B2B exceptions to January 1, 2022, now includes language that it shall only become operative if voters do not approve the CPRA. |
|
| On July 1, 2020, the California Attorney General was statutorily permitted to begin enforcing the CCPA. The CCPA requirements remain in flux in part because the CCPA regulations have yet to be approved and finalized. |
July 1, 2020
CCPA Enforcement Date
|
|
|
November 3, 2020
California Statewide General Election
|
The CPRA will be set to become law if it is approved by a majority vote at the Statewide General Election on November 3, 2020.
The Californians for Consumer Privacy currently predict 88 percent of California voters would vote YES to support a ballot measure expanding privacy protections for personal information, like the CPRA. As a result, there appears to be sufficient support for the CPRA to become law. |
|
| In accordance with Article II, § 10(a) of the California Constitution, a ballot initiative that is approved by a majority vote at the statewide general election takes effect the fifth day after the Secretary of State certifies the election results, unless the initiative measure provides otherwise.
On the fifth day after certification, the following provisions of the CPRA become law in accordance with Section 31(b) of the CPRA:
- Section 1798.145(m)-(n): The extensions of the personnel/employee exception and B2B exception to January 1, 2023.
- Section 1798.160: The creation of a “Consumer Privacy Fund.”
- Section 1798.185: The direction for the Attorney General to adopt regulations and the mechanism to transfer regulatory authority to the new privacy agency.
- Section 1798.199.10-40: The establishment of the California Privacy Protection Agency, the new privacy agency vested with full administrative power, authority and jurisdiction to implement and enforce the CCPA, as amended by the CPRA.
- Section 1798.199.95: The designation of funds for the new California Privacy Protection Agency.
|
Likely Mid-December 2020
Preliminary CPRA
Effective Date
|
|
|
July 1, 2021
Transfer of Regulatory Authority to New Privacy Agency
|
In accordance with Section 21 of the CPRA, beginning the later of July 1, 2021, or six months after the new agency provides notice to the California Attorney General that it is prepared to begin rulemaking activity, the authority assigned to the California Attorney General to adopt regulations under the CPRA shall be exercised by the new California Privacy Protection Agency. |
|
| In accordance with Section 31(a) of the CPRA, the obligations under the CPRA, with the exception of the right of access, will only apply to personal information collected by the business on or after January 1, 2022. |
January 1, 2022 Look-Back Period
|
|
|
July 1, 2022 Deadline for Adopting Final Regulations
|
In accordance with Section 21 of the CPRA, the final regulations under the CPRA must be adopted by July 1, 2022. |
|
In accordance with Section 31(a) of the CPRA, the remainder of the CPRA becomes operative on January 1, 2023, including the highlights from the CPRA we describe in more detail here:
- Revision and expansion of the scope of covered “businesses” under Cal. Civ. Code § 1798.140(d).
- Addition of a new category of personal information—“sensitive personal information.”
- Expansion of the requirements for the notice at collection.
- Adoption of an explicit, overarching purpose-limitation obligation.
- Addition of new consumer rights and revision of existing obligations.
- Expansion of contracting requirements with third parties, service providers and “contractors.”
- Modification of statutory exceptions.
- Imposition of “reasonable security” obligations.
- Expansion of the breach private right of action.
- Revision of fine structure for violations involving children’s information.
|
January 1, 2023
Full Operative Date
|
|
|
July 1, 2023 Enforcement Date
|
In accordance with Section 21 of the CPRA, civil and administrative enforcement of the obligations added by the CPRA cannot begin until July 1, 2023, and can only apply to violations occurring on or after that date. |
|
