The California Senate and Assembly have passed five amendments to the California Consumer Privacy Act (CCPA). The amendments that are applicable to financial institutions include:
- Methods for Submitting Requests (Section 1798.130) – Financial institutions that operate exclusively online and that have a direct relationship with a consumer that it collects personal information from are only required to make an e-mail address available to a consumer to submit a request for information. If a financial institution maintains a website, that website must also be made available to consumers to submit a request for information. Prior to this amendment, a toll-free number and a website were required at a minimum, designated methods for submitting consumer requests. Lastly, a business may require consumer authentication that is reasonable in light of the personal information collected, but a consumer will not be required to create an account to submit a request. If a consumer maintains an account, the consumer may be required to submit a request via the account.
- Personal Information Definition (Section 1798.140) – The definition of “personal information” was redefined to exclude consumer information that is deidentified or aggregate consumer information. The CCPA defines “deidentified information” as information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer. This definition remains unchanged. The amendments also updated the definition of “personal information” to include information that “is reasonably capable of being associated with….”
- Information Collected Outside the Ordinary Course of Business (Section 1798.145) – Financial institutions are not required under the CCPA to collect personal information that would not otherwise be collected in the ordinary course of business, and they would not be required to retain personal information for longer than the normal retention period.
The California governor must sign the amendments by October 13, 2019. No changes were made to the January 1, 2020 effective date or the July 1, 2020 enforcement date.
Links to amendments: AB 1564, AB 25, AB 874, AB 1146, and AB 1355