Written by Haim Ravia and Dotan Hammer
The California Privacy Protection Agency (CPPA) published for public comment draft regulations implementing the reform in the state’s privacy law, given the overhaul of the California Consumer Privacy Act (CCPA) by the California Privacy Rights Act (CPRA) expected to take effect in January 2023.
The new regulations mainly focus on adapting the existing regulations (enacted under the CCPA) to the CPRA and establishing the required framework for implementing the provisions of the CPRA. The California Privacy Protection Agency stated that in making the proposed adaptations, it considered the requirements of the corresponding laws in Utah, Connecticut, Virginia, and Colorado, as well as those of the GDPR, to ease the burden of compliance imposed on California businesses which may be subject to several privacy laws at once.
The regulations set out, among other things:
- Rules for disclosures to consumers so that they are easy to read and understandable, available in the languages in which the business usually provides information to consumers, and reasonably accessible to consumers with disabilities.
- Updated rules on the exercise of consumers’ rights to delete or correct the personal information that the business collected about them, and the right to opt-out of the sale or sharing of their personal information by the business.
- Rules on the use and sharing of sensitive information.
- More extensive rules on the processing of personal information by service providers on behalf of a business.
- Rules for conducting governmental audits and for filing complaints with the California Privacy Protection Agency.
CLICK HERE to read the proposed California Consumer Privacy Act Regulations. The draft is open for public comments until August 23, 2022.
CLICK HERE to read the Initial Statement of Reasons for the proposed California Consumer Privacy Act Regulations.
