About Us: Overview
Firm Accolades
Overheard in Bankruptcy
Environmental Law Blog
Copyright Lately
The Grass is Always Greenberg
HomeInsightsCalifornia Attorney General Issues Proposed Regulations For California Consumer Privacy Act (CCPA)
California Attorney General Issues Proposed Regulations For California Consumer Privacy Act (CCPA)
October 15, 2019 – Client Alert
By Timothy Toohey
On October 11, 2019, the California Attorney General provided notice of proposed regulations concerning the California Consumer Privacy Act (CCPA), California Civil Code §§ 1798.100-1798.198. These regulations are not final and have already been criticized by some as having created confusion rather than clarity. However, businesses with existing privacy policies and procedures should consult with counsel knowledgeable about the regulations to determine whether they need to amend their privacy policies to comply with the CCPA before it goes into effect on January 1, 2020. Because the rights conferred by the European Union's 2018 landmark General Data Protection Regulation ("GDPR") differ in many ways from those of the CCPA, businesses should review their privacy policies even if they recently amended them to comply with the European law.
The CCPA will require businesses subject to its terms to provide significant new rights to California consumers regarding their personal information. The "businesses" governed by the CCPA include any for-profit business that has:
gross revenues in excess of $25 million; or
buys, receives, or sells the personal information of 50,000 or more California consumers, households or devices; or
derives 50 percent or more of its annual revenues from selling consumers' "personal information."
In contrast to prior laws, the CCPA broadly defines "personal information" as any information that "identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." The CCPA thus includes both information previously defined as "personal information," such as name in combination with identifiers such as a social security number or driver's license number, plus other information such as purchasing history, biometric information, internet activity, geolocation data, employment information and education information.
The rights conferred by the CCPA on California consumers are in some respects similar to those granted EU residents under the GDPR. These rights include the "right to know," which gives consumers the ability to request that a business disclose to them certain information, including (1) specific pieces and general categories of information collected about the individual, (2) the purposes for which the information was collected and (3) categories of third parties to whom the personal information was sold. Consumers also have a qualified right to delete certain information collected by the business, a right to direct businesses not to sell their personal information, and a non-discrimination right for exercising their rights under the CCPA.
Significantly, the CCPA, like existing law (including the GDPR) requires businesses to inform consumers "at or before the point of collection" of the categories of personal information collected about them and the purposes for which it will be used. For example, Civil Code § 1798.130 requires businesses subject to the CCPA to disclose in a privacy policy a description of a consumer's rights under the CCPA, including how the consumer can submit requests for disclosure, deletion and opting-out of the sale of personal information, and additional information regarding data collection and sharing practices.
Under AB 25, which Governor Newsom signed on October 11, 2019, employers are exempted until January 1, 2021 from certain requirements of the CCPA, including those pertaining to information collected "by a business in the course of the natural person acting as a job applicant to, an employer of, director of, officer of, medical staff member of, or contractor of that business." A forthcoming client alert will address in detail the applicability of the CCPA to employers and employees.
The proposed regulations announced by the California Attorney General's office provide guidance on how businesses subject to the CCPA must comply with these obligations in their public privacy policies and internal procedures. For example, businesses with online privacy policies relating to their internet sites may need to consider amending those policies to comply with sections 999.305 (notice at collection of personal information) and 999.308 (privacy policy) of the proposed regulations. These regulations include elements that are typical in existing privacy policies, such as description of the categories of information collected and the purposes for the collection. They also include new requirements for "plain, straightforward language" and avoidance of "technical or legal jargon," as well as a requirement that the policy be available "in the languages in which the business in its ordinary course provides contracts, disclaimers, sale announcements, and other information to consumers." The regulations also contain unprecedented technical requirements for notices and policies, including announcements of consumers' rights for deletion of information, description of a business verification process, and the methods that the business will use to validate consumer requests.
An important aspect of the CCPA and the proposed regulations is the requirement that qualifying businesses that collect personal information from consumers by methods other than through a website provide California consumers with notices that are compliant with the CCPA. Thus, professional service firms such as accountants and lawyers must provide their clients with privacy notices at the time of collection that conform to the proposed regulations.
The CCPA is a watershed in U.S. privacy laws. Although there have been proposals to implement a federal statute that will supersede such state privacy laws, the passage of such a law is by no means certain in today's political climate. Businesses that are subject to the CCPA should therefore promptly act to modify existing policies and procedures to meet the January 1, 2020 deadline.
Timothy J. Toohey
Pay Retainer
Greenberg Glusker Fields Claman & Machtinger LLP
2049 Century Park East·Suite 2600·Los Angeles, CA·90067·310-553-3610·[email protected]
Copyright © 2022 Greenberg Glusker Fields Claman & Machtinger LLP. Website Credits
Type a name or keyword
Select a position
Partner Emeritus
Bankruptcy, Reorganization & Capital Recovery
Branded Consumer Products
Restaurant, Food & Beverage
Other Consumer Products
Cannabis Industry Group
Climate Change & Sustainability
Carbon Regulation & Trading
Climate Change Litigation
Green Building & LEED Compliance
Corporate, Finance & Securities
Corporate Structuring & Operations
Family Business Planning
Financing Transactions
Joint Ventures & Strategic Alliances
Digital Media & Technology
Preventive Counseling
Real Estate Due Diligence & Risk Management
Regulatory & Compliance Counseling
Film Financing
Clearance & Due Diligence
Copyright Protection & Enforcement
IP Transactions: Licensing, Acquisitions & Dispositions
Online Compliance & Enforcement
Trademark Protection, Enforcement & Drafting
Websites, Domain Names & Privacy
Entertainment Litigation
Investment Fraud Litigation
Probate, Trusts & Estates Litigation
Music Law
Opportunity Zone Group
Charities & Nonprofit Organizations
High Net Worth Families
Trusts & Estates Administration
Trusts & Estates Controversy
Trusts & Estates Planning
Acquisitions & Sales
Related Real Estate Industry Groups
Restructuring & Loan Workout
Video Games, Streaming & Esports
Indiana University School of Law
Loyola Law School
Oberlin College
Russian State Institute of Cinematography (VGIK)
Stanford University School of Law
State University of New York at Albany
UCLA Anderson School of Management
University of California, Berkeley School of Law
University of California, Davis School of Law
University of California, Hastings College of the Law
University of California, Los Angeles School of Law
University of Pennsylvania Carey Law School
University of Southern California Gould School of Law
University of Southern California Marshall School of Business
University of Witwatersrand, Johannesburg, South Africa
Wadham College, University of Oxford
Washington University School of Law
Westminster Theological Seminary
Yale Graduate School of Arts & Sciences
Select a bar admission
ABCDEFGHIJKLMNOPQRSTUVWXYZView All
The Laboring Oar®