Content
The California Privacy Rights Act (CPRA) of 2020, also known as Proposition 24, is an amendment to the California Consumer Privacy Act (CCPA). Note that the federal Children’s Online Privacy Protection Act regulations apply in addition to CCPA requirements. If your business sells goods or services to or collects the personal information of California residents and meets one of the other threshold requirements, you must follow CCPA. In 2022, T-Mobile faced a class-action lawsuit alleging violations of the CCPA due to a data breach that exposed sensitive information 76 million customers, including Social Security numbers, dates of birth, and driver's licenses information. Additionally, Honda allegedly shared consumer data with advertising partners without proper contractual safeguards. To help you evaluate your company’s CCPA compliance readiness, download the CCPA compliance checklist below.
Covered businesses should consider this and when drafting notices for consumers concerning their rights under the CCPA. If a business cannot provide consumers a specific retention period, the business must provide consumers the “the criteria used to determine such period ….” In addition, courts and enforcement bodies may view storage limitation practices as a basic reasonable safeguard. However, as made clear under the CPRA, businesses must apply data minimization principles concerning personal information. Before a consumer can bring a lawsuit following a covered business’s data breach, they must provide the covered business 30 days’ written notice identifying the specific provisions of the CCPA/CPRA that were violated. The CCPA authorizes a private right of action against a covered business if its failure to maintain reasonable security safeguards results in a data breach affecting personal information.
A company’s location alone doesn’t determine its obligations; the California privacy law focuses on business activity and scale. California’s privacy landscape has evolved significantly since 2018, with the original California Consumer Privacy Act (CCPA) serving as the foundation for what is now a comprehensive privacy framework enhanced by the California Privacy Rights Act (CPRA). For businesses newly navigating compliance, understanding these evolving regulations isn’t just a legal checkbox — it’s a pathway to protecting their brand, earning customer trust, and reducing the risk of costly breaches. Contractors, a new category introduced by the CPRA, are similar to service providers but are bound by a written contract that includes a certification of understanding and compliance with the contract's terms.
Services
Businesses subject to risk assessment requirements must comply from January 1, 2026, while ADMT requirements apply from January 1, 2027. Non-compliance can have major repercussions, which is why it’s important to tick every box on this CPRA compliance checklist. Offer compliance training to all https://labverra.com/articles/understanding-patient-record-databases/ employees, focusing specifically on those who handle consumer data or are involved in processing consumer rights requests. As such, your contracts with these entities must include specific provisions that require them to comply with CPRA regulations. To achieve CPRA compliance, you need a thorough understanding of the personal information you handle. Understanding this legislation is key for businesses hoping to achieve CPRA compliance and demonstrate a commitment to protecting consumer data.
- If a business intends to collect or use additional categories of personal information for purposes incompatible with the original purpose, it must notify the relevant consumers and obtain their consent.
- This requirement emphasizes the importance of aligning data processing activities with the original purpose of collection and obtaining consumer consent for any additional purposes.
- While maintaining the basic framework of the right to delete, the CPRA provides additional guidance on passing these requests downstream.
- By the end of this article, you’ll have a clear understanding of the steps necessary to ensure your organization is prepared for the CPRA’s implementation in 2024.
- They should regularly review the personal information in their possession to determine whether it remains adequate, relevant, and necessary for the specified purposes.
From January 1, 2027, rights to opt out of and access information about automated decision-making technology (ADMT) will apply too. ▢ Do not ask again for 12 months before requesting permission to sell, share, or use sensitive data further. Update the training required for staff responsible for handling consumer rights requests (and document the training) to reflect regulatory updates. Covered businesses should be negotiating, reviewing, or renegotiating existing agreements as soon as possible to ensure agreements are timely in place. Monitor CCPA legislative and regulatory activity to ensure the business is aware of additional amendments. In addition, although the CCPA is drafted to supplement federal and state law, it will not apply if it is preempted by or in conflict with federal law, the U.S.
Perform Risk Assessments and Annual Cybersecurity Audits
It’s currently entirely in force with a look back to July 1, 2023, but this was not the original plan. In November 2020, California residents voted the California Privacy Rights Act (CPRA) into law — an amendment and expansion of the 2018 California Consumer Privacy Act (CCPA). A company scrambling to rectify privacy violations may find itself excluded from lucrative contracts or acquisition opportunities. Additionally, certain datasets — such as information protected by HIPAA or GLBA — are carved out under sector-specific laws, though mixed datasets often require careful segmentation to avoid accidental exposure.
To avoid penalties and fines, regularly review updates from CPPA to stay compliant with the latest version of California's data privacy law. Organizations also must complete vendor risk assessments to identify and mitigate any additional security risks. These agreements should stipulate terms that comply with CCPA and CPRA requirements, including processing personal information following your organization's instructions and assisting in fulfilling consumer rights requests. Additionally, the notice must contain a link to your organization’s privacy policy so that consumers can get a fuller description of their privacy rights and the organization’s privacy practices if they want. This includes a web page that clearly offers an opt-out option with a link to your privacy policy. Read over the contractual provisions in CPRA and start amending the contracts and contract templates for third parties, contractors, and service providers.
How does the CCPA affect entities that provide services to businesses?
Put into effect on January 1, 2023, and enforced by the California Privacy Protection Agency, it was created to protect consumers against data misuse following public scandals that were in clear violation of their privacy. ADMT rules apply from January 1, 2027, and cybersecurity audit reports are due between April 1, 2028 and April 1, 2030, depending on revenue. Subcontractors need compliant contracts too, and third parties that receive data from you have their own required terms.
Third parties are entities that receive personal information from businesses but don't qualify as service providers or contractors. The CPRA expands the definition of a business to include entities that meet certain revenue or data volume thresholds. The CPRA establishes the California Privacy Protection Agency (CPPA), a dedicated https://autonow.net/what-is-quickbooks-consulting-and-how-does-it-help-businesses-manage-their-finances.html agency responsible for enforcing and implementing the CPRA.
