Take steps internally to prepare for new rights and requirements

Businesses should take comfort that the Jan. 1, 2023, effective date and delayed enforcement start (July 1, 2023), means there is time to come into compliance. However, the law imposes various changes that will require businesses to address new considerations — even factoring in the efforts many already have made to comply with the CCPA — including:

Determining what "sensitive information" is maintained. Businesses must now differentiate between general "personal information" and "sensitive information," the latter of which requires additional compliance measures, including relating to disclosing the collection and use of such information, and a new right for consumers to limit the business's use of the information.
Reconsidering whether the business "sells" information and providing an opt-out. CPRA explicitly expands the CCPA's definition of "sale" to include sharing of personal information even without the exchange of money and "cross-context behavioral advertising." As a result, businesses that fell outside of the CCPA definition of "sale" may fall within the CPRA definition. Further analysis will require digging into the business's advertising activities (e.g., business practices in ad tech, advertising-related contracts, whether uses of personal information provided by the business to third parties are limited to the business's purposes, and uses of cookies and pixels), and whether additional efforts to minimize data sharing or cross-contextual use is necessary. In light of CCPA, certain tech companies have afforded options for limiting such data uses, and other advances are likely to result from the CPRA.
Laying the groundwork for employees/contractors and individuals whose personal information is gathered in B2B transactions. Although various exemptions have governed the handling of this data under the CCPA, under the CPRA, businesses will need to consider their own California workforce and California business contacts as consumers. Particularly in light of COVID-19, businesses are collecting sensitive information from employees with more frequency than ever before. Mapping out the information collected, how it is used, and where it is going will be particularly important to comply with requests, including rights to access, delete, or limit the use of data.
Evaluating data minimization and data retention practices. The CPRA is the first U.S. law to memorialize rights to data minimization (only using information as necessary) and limited data retention. Whereas data retention policies and minimizing the collection of information were previously best practices in the United States, failure to address these will now be an actionable violation.
Updating disclosures — again. Businesses will need to update their privacy policies, web links, and other disclosures to cover CPRA and individuals' additional rights, including relating to the sharing opt-out and limited use option discussed above. Once again, however, businesses have another two years (Jan. 1, 2023) before these disclosures are required.
Reviewing third party relationships where personal information is shared. Businesses should again consider amendments to agreements with third parties, including to ensure that new obligations and distinctions are covered, such as the obligation that service providers must assist businesses with executing individual rights.

Businesses will need to remain nimble in their efforts to come into compliance, as the law will undoubtedly morph in light of implementing regulations that may not be finalized until approximately 18 months from now.

Special Reports /

Businesses should brace for new U.S. privacy regulations, enforcement

Related Stories

Recommended For You