On November 3, 2020, California voters as part of the general election approved an initiative statute, California Privacy Rights Act of 2020 (CPRA), to amend and expand upon existing consumer privacy laws. The CPRA would amend the California Consumer Privacy Act of 2018 (CCPA) by expanding upon the CCPA’s privacy rights and obligations, including the following changes, among others:
- Allow a consumer to request a business to correct inaccurate personal information that it maintains.
- Permits consumers to opt out of the sharing of personal information with third parties and not just the sale of personal information as was enacted by the CCPA.
- Add a new category of personal information, “sensitive personal information,” which includes information such as a consumer’s social security number, driver’s license number, account log-in, financial account, precise geolocation, personal information revealing a consumer’s racial or ethnic origin or religion, contents of a consumer’s private communications, among others.
- Require a business to disclose, at or before the point of collection, if the business collects sensitive personal information, the categories of sensitive personal information to be collected, and the specific purpose for which the categories of sensitive personal information are collected, used, or sold.
- Require a business to disclose, at or before the point of collection, the length of time the business intends to retain each category of personal information and sensitive personal information.
- Enable a consumer to have the right to opt-out of the use of disclosure of the consumer’s sensitive personal information for advertising or marketing and provide a link on the business’s website in order for the consumer to do so.
- Require opt-in consent by a consumer in order for a business to sell their sensitive personal information.
- Require businesses to notify consumers when a security breach has occurred and their sensitive information has been compromised.
- Implement an independent watchdog whose mission is to protect consumer privacy by ensuring that businesses and consumers are well-informed of their rights and obligations and to enforce the law against businesses that violate consumers’ privacy rights.
The CPRA will not take effect until January 1, 2023 with a delayed enforcement date of July 1, 2023. More information regarding the CPRA can be found here.