If the past two years of ramping up compliance for the California Consumer Privacy Act (CCPA) wasn't fun enough, businesses have new compliance challenges ahead in the next couple of years. This past November, California voters passed the California Privacy Rights Act (CPRA). The CPRA was a ballot initiative that modifies and expands the CCPA. It adjusts the criteria for applicability, adds a category for sensitive personal information, gives individuals new rights and also expands some of the existing CPRA rights. It also creates a new private enforcement authority and adopts some principles from the GDPR. Businesses will need to start modifying their privacy practices ahead of the CPRA effective date, January 1, 2023.
Step one is simple; get the acronyms right. These two laws rival confusion between the now enjoined Children's Online Protection Act (COPA) and the alive and well Children's Online Privacy Protection Act (COPPA). After that, take a deep breath, as there is some time to comply. One positive is that the Business to Business and Employee exceptions have been extended from January 1, 2022 to January 1, 2023. Keep in mind, though, that the look-back period for privacy requests under CPRA will date back to January 1, 2022.
Another positive is on the applicability front. While the $25 million in annual revenue threshold remains, the threshold on buying, sharing or selling personal information was increased from 50,000 or more consumers, households or devices to 100,000 consumers or households. That increase in amount helps small businesses. The addition of the newly defined term "share" expands the scope of this threshold a bit. The definition of "sell" was broad to begin with, however, there is considerable overlap between these terms in the CCPA and CPRA. The main distinction is that "share" is limited to cross-context behavioral advertising and does not have a consideration element.
Support the originator by clicking the read the rest link below.
