By: Linda L. Goodman
Just as the California AG begins enforcement of CCPA, despite the fact that the final regulations are not in place. The California Privacy Rights Act of 2020 (“CPRA”) will be on the November ballot. If passed, some provisions of the law would take effect on January 1, 2023 with a July 1, 2023 enforcement date. The CPRA is a ballot initiative sponsored by Californians for Consumer Privacy, a group headed by Alastair Mactaggert, who is the same group which led a ballot initiative in 2018 resulting in the hastily pass the California Consumer Privacy Act (“CCPA”). The CPRA supplements privacy protections for Californians that the existing CCPA imposes on companies that collect personal information from consumers.
The ballot initiative includes several provisions that its proponents contend strengthen the state’s existing privacy regime. Among other things, CPRA would:
- Make it extremely difficult for the California legislature to weaken privacy protections in the future because it would require that any amendment be “in furtherance of the purpose and intent” of the CPRA. As such, if this passes, don’t expect further amendments to the CCPA;
- Adds to the definition of personal information – email and passwords that if lost or breach, would give the affected consumers the right to bring private lawsuits.
- Creates a new category of sensitive personal information and give consumers the ability to limit use of this data. Information in this new category would include social security number; driver’s license number; passport; consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password or credentials allowing access to an account; consumer’s precise geolocation; consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership; contents of a consumer’s mail, email and text messages, unless the business is the intended recipient; consumer’s generic data; the processing of biometric information for the purpose of uniquely identifying a customer; personal information collected and analyzed concerning a consumer’s health; and personal information collected and analyzed concerning a consumer’s sex life or sexual orientation.
- Limit precise geolocation tracking to a location within roughly 250 acres.
- Increase the maximum penalties threefold for violations concerning consumers under age 16.
- Establish the California Privacy Protection Agency, funded with $10,000,000 from California’s General Fund (which essentially has no money), to implement and enforce the new law, as well as impose administrative fines. Thus, we will see fines going to the bureaucracy and not consumers, similar to what has been observed with the Federal CFPB.
Californians for Consumer Privacy has posted a fact sheet, titled “Why CPRA,” on its website.
We will continue to monitor the CPRA and develop yet additional compliance protocols while simultaneously preparing for enforcement of the CCPA.
______________________________________________________________________
This article is a publication of The Goodman Law Firm and is intended to provide information on recent legal developments. This article does not create an attorney-client relationship, nor should it be construed as legal advice or an opinion on specific situations. This may constitute “Attorney Advertising” under the Rules of Professional Conduct and under the law of other jurisdictions.
Linda L. Goodman is the founder of The Goodman Law Firm, concentrating its practice in internet business and law. Her firm’s clients include Advertisers, Affiliates, Affiliate Networks, and ISP’s.
© 2020 TGLF, A.P.C.