California Voters approve new Privacy Legislation CPRA
On November 3rd 2020, Californian citizens were able to vote on the California Privacy Rights Act of 2020 (“CPRA”) in a state ballot (we reported). As polls leading up to the vote already suggested, California voters approved the new Privacy legislation, also known as “Prop 24”. The CPRA was passed with 56.2% of Yes Votes to 43.8% of No Votes. Most provisions of the CPRA will enter into force on 1 January 2021 and will become applicable to businesses on 1 January 2023. It will, at large, only apply to information collected from 1 January 2022.
The CPRA will complement and expand privacy rights of California citizens considerably. Among others, the amendments will include:
- Broadening the term “sale” of personal information to “sale or share” of private information,
- Adding new requirements to qualify as a “service provider” and defining the term “contractor” anew,
- Defining the term “consent”,
- Introducing the category of “Sensitive Information”, including a consumer’s Right to limit the use of “Sensitive Information”,
- Introducing the concept of “Profiling” and granting consumers the Right to Opt-out of the use of the personal information for Automated Decision-Making,
- Granting consumers the Right to correct inaccurate information,
- Granting consumers the Right to Data Portability, and
- Establishing the California Privacy Protection Agency (CalPPA) with a broad scope of responsibilities and enforcement powers.
Ensuring compliance with the CPRA will require proper preparation. Affected businesses will have to review existing processes or implement new processes in order to guarantee the newly added consumer rights, meet the contractual requirements with service providers/contractors, and show compliance with the new legislation as a whole.
In an interview after the passage of the CPRA, the initiator of the CCPA and the CPRA Alastair Mactaggard commented that
Privacy legislation is here to stay.
He hopes that California Privacy legislation will be a model for other states or even the U.S. Congress to follow, in order to offer consumers in other parts of the country the same Privacy rights as there are in California now.