California Is at It Again: The California Privacy Rights Act Makes November Ballot

The Californians for Consumer Privacy group is continuing to push for increased rights regarding consumer data through the California Privacy Rights Act (CPRA), a measure that would expand the rights granted under the existing California Consumer Privacy Act (CCPA), which was effective on January 1^st of this year. On June 24^th, the California Secretary of State confirmed that the CPRA initiative collected 900,000 signatures, which was enough to qualify for the November ballot.

The proposed CPRA would expand the privacy rights granted to California residents under the CCPA by:

• Establishing the California Privacy Protection Agency to enforce rights under the CPRA, unlike the CCPA which is enforced by the California Attorney General;
• Tripling penalties associated with violations related to children’s personal information;
• Providing California residents with new rights regarding the use of “sensitive personal information,” a new category of personal information established by the CPRA;
• Expanding the CCPA private right of action to apply to any consumer whose email address in combination with a password or security question and answer that would permit access to the account;
• Clarifying the meaning of “consent” as a “clear affirmative action” that “signifies agreement”; and
• Broadening the obligations of a covered business to provide notice to consumers regarding its sharing and collection practices, including requiring the covered business to provide the length of time the business intends to retain each category of personal information and a separate disclosure for “sensitive personal information” collected.

Of these, the expansion of the private right of action and the associated litigation risk may have the greatest impact.

If the CPRA passes, business may again need to make major changes to their privacy practices not long after working to meet the requirements of the landmark CCPA. The good news is that the CPRA would not take effect until January 1, 2023, giving businesses some time to plan and allocate resources accordingly.