On June 24, 2020, the California Secretary of State announced that the California Privacy Rights Act (CPRA or CCPA 2.0) has received enough signatures, and those signatures were verified, to be placed on California’s general election ballot that takes place on November 3, 2020.
The CPRA would amend the California Consumer Privacy Act of 2018 (CCPA) by expanding upon the CCPA’s privacy rights and obligations, including the following changes, among others:
- Allow a consumer to request a business to correct inaccurate personal information that it maintains.
- Add a new category of personal information, “sensitive personal information,” which includes information such as a consumer’s social security number, driver’s license number, account log-in, financial account, precise geolocation, personal information revealing a consumer’s racial or ethnic origin or religion, contents of a consumer’s private communications, among others.
- Require a business to disclose, at or before the point of collection, if the business collects sensitive personal information, the categories of sensitive personal information to be collected, and the specific purpose for which the categories of sensitive personal information are collected, used, or sold.
- Require a business to disclose, at or before the point of collection, the length of time the business intends to retain each category of personal information and sensitive personal information.
- Enable a consumer to have the right to opt-out of the use of disclosure of the consumer’s sensitive personal information for advertising or marketing and provide a link on the business’s website in order for the consumer to do so.
- Require opt-in consent by a consumer in order for a business to sell their sensitive personal information.
- Require businesses to notify consumers when a security breach has occurred and their sensitive information has been compromised.
- Implement an independent watchdog whose mission is to protect consumer privacy by ensuring that businesses and consumers are well-informed of their rights and obligations and to enforce the law against businesses that violate consumers’ privacy rights.
If the CPRA passes in November it will become effective on January 1, 2023.