Digging in to recent amendments and regulations

Legislative proposals to amend the California Consumer Privacy Act (“CCPA”) statute were recently signed, finalizing the law for its January 1, 2020 effective date.  Highlights from amendments to the law include:

  • Broadened exemptions for compliance with the Fair Credit Reporting Act, and specifically excluded deidentified and aggregate consumer information from the definition of “personal information”
  • Created a one-year exemption for certain B2B transactions along with a one-year exemption for employee information
  • Streamlined definition of “publically available” information.
  • Consumer request methods were further detailed
  • “Data brokers” are now required to register with the California Attorney General

The day before these amendments were signed into law, the California Attorney General also released draft regulations that proposed rules to direct businesses on how they can comply with the law. The Attorney General will hold public hearings on the draft regulations and accept written comments, so it is likely these regulations will be revised and might not go into effect until after the CCPA becomes effective on January 1, 2020.

By and large, the regulations proposed by the Attorney General provide useful guidance, but there are some unexpected components that, if adopted, could greatly impact organizations ability comply. A few of the provisions Alliant is carefully watching include:

  • Businesses would be required to provide clear, conspicuous, and understandable notice to consumers of their privacy practices at or before the time their personal information is collected
  • A new requirement to use consumer’s information only in a manner consistent with the notice provided, and directly notify consumers to obtain explicit consent to use the information in a way not previously disclosed
  • Clearly defined a “household,” which is an important concept in consumer information, as “a person or group of people occupying a single dwelling”
  • Clarified various methods of communicating with consumers, and requires explanations of incentives or price differences for sale of information

Alliant will continue to build its CCPA compliance procedures based on the solidified statutory language, while also tracking the moving target of regulations over the next several months. Please consult with qualified counsel, or join our CCPA updates & education series, if you have any questions on the impact of these rules.

ABOUT THE AUTHOR

Nick Godlove, Corporate Counsel

Nick came to Alliant after a successful career in private practice advising technology companies on privacy and contracts. He is deeply involved in Alliant’s data security and consumer privacy efforts. Nick earned his law degree at UC Davis and holds a Masters in Cybersecurity from Brown. Nick loves his subscription to Audible, where he listens to a classic novel each month.