While the 2020 election did not deliver an immediate consensus on every candidate and issue, one thing is clear: Californians want more control over personal information and have demanded that businesses take their privacy seriously. Less than a year after the United States’ first major comprehensive consumer privacy law – the California Consumer Privacy Act of 2018 (“CCPA”) – went into effect, and Californians voted in support of Proposition 24, which will eventually replace the CCPA with the new California Privacy Rights Act (“CPRA”).
The CPRA will build on the CCPA by introducing additional privacy protections for California residents and requiring the businesses subject to those laws to revisit once again and update their privacy programs. Although some provisions of the CPRA will be effective immediately after the CPRA becomes law, the majority of the law will not become operative until January 1, 2023. Still, it will apply to personal information collected on or after January 1, 2022.
Among the provisions taking immediate effect are an extension of the employee and business-to-business exceptions until January 1, 2023, giving businesses subject to the CCPA/CPRA more time as they work to come into compliance with these already delayed requirements. The CPRA also immediately creates the California Privacy Protection Agency. This new agency will be “vested with full administrative power, authority and jurisdiction to implement and enforce the CCPA, as amended by the CPRA” and is supported by three other measures that fund, transfer authority to the agency kick-off the next round of rulemaking.
The CPRA is intended to bring California’s consumer privacy law into closer alignment with the EU’s General Data Protection Regulation (“GDPR”) by giving California residents more concrete controls over their personal information. The law introduces the GDPR-like right to correct the personal information held about them and additional protections for the new category of “sensitive” personal information. It will require more specific disclosures from businesses about what personal information they collect and share. It also codifies the definition of “consent,” increases protections for children’s personal information under the age of 16, targets geolocation data and cross-context behavioral marketing, and only permits legislators to make changes designed to strengthen privacy. The CPRA even modifies the now ubiquitous “Do Not Sell My Personal Information” website opt-outs to incorporate new rights for consumers to also opt-out to share their personal information and limit the use of their sensitive personal information.
For businesses, the CPRA amends the thresholds triggering the requirement to comply with the law, reducing the number of smaller businesses subject to its obligations. Under the CPRA, the $25 million revenue threshold will look back to the prior calendar year. The “volume” threshold has been revised so that it applies to a business that “annually buys or sells, or shares the personal information of 100,000 or more consumers or households,” up from 50,000 consumers and households while eliminating “devices” as a defined collection point. Finally, the “data broker” threshold has been amended, so the CPRA applies to businesses that derive 50% or more of their annual revenues from selling or, now, sharing consumers’ personal information. If your company does business in California and you have not yet evaluated whether you must comply with CCPA, it is not too late to start working toward compliance and preparing for the operational date of the CPRA.
Planning for the future of privacy requirements should be a serious consideration for all businesses. States across the country have implemented various privacy, data breach laws, and more under consideration in states such as Illinois, New York, and Washington. If you have questions about whether or how CPRA or other privacy laws apply to your business and what you need to do to comply, please reach out to us to discuss how to protect the privacy of your customers’ personal information.
ABOUT DAVID JOHNSON
David Johnson is a Principal attorney in the Intellectual Property practice group. He helps businesses manage complex brand issues, focusing on intellectual property strategies, prosecution, and enforcement. He also works on a wide variety of branding and technology-related matters, including social media and advertising, privacy, product and packaging claims review, and intellectual property transactions. Mr. Johnson draws on his in-house legal and business experience to partner closely with clients to help them plan for their long-term business goals and tolerances for risk in strategically managing, building, and protecting multi-national intellectual property portfolios. He has experience advising clients ranging from pre-launch start-ups to Fortune 100 companies. Mr. Johnson also has experience guiding clients through a wide range of commercial transactions including IP acquisitions and licensing, influencer engagements, and publishing agreements.
ABOUT OFFIT KURMAN
Offit Kurman is one of the fastest-growing full-service law firms in the United States. With 14 offices in seven states, and the District of Columbia, and growing by 50% in two years through expansions in New York City and Charlotte, North Carolina, Offit Kurman is well-positioned to meet the legal needs of dynamic businesses and the individuals who own and operate them. For over 30 years, we’ve represented privately held companies and families of wealth throughout their business life cycles.
Whatever and wherever your industry, Offit Kurman is the better way to protect your business, preserve your family’s wealth, and resolve your most challenging legal conflicts. At Offit Kurman, we distinguish ourselves by the quality and breadth of our legal services—as well as our unique operational structure, which encourages a culture of collaboration and entrepreneurialism. The same approach that makes our firm attractive to legal practitioners also gives clients access to experienced counsel in every area of the law.
Find out why Offit Kurman is The Better Way to protect your business, your assets and your family by connecting via our Blog, Facebook, Twitter, Instagram, YouTube, and LinkedIn pages. You can also sign up to receive LawMatters, Offit Kurman’s monthly newsletter covering a diverse selection of legal and corporate thought leadership content.
DELAWARE | MARYLAND | NEW JERSEY | NEW YORK | NORTH CAROLINA | PENNSYLVANIA | VIRGINIA | WASHINGTON, DC