On November 3, 2020, California voters approved California Proposition 24, also known as the California Privacy Rights Act of 2020, or CPRA. The CPRA expands protections afforded to personal information, building off of the California Consumer Privacy Act (CCPA), which took effect in January of this year. While some of the CPRA changes will take effect immediately, most will not become enforceable until July 1, 2023, and apply only to personal information collected after January 1, 2022.

Key Changes to CA Privacy Law

At 54 pages long, the CPRA makes numerous changes to the CCPA, ranging from minor revisions to the introduction of new concepts and the creation of several new consumer rights. Some of the most impactful changes are discussed below. A series of future client alerts will explore the nuances of these changes in greater detail.

Sensitive Personal Data

The CPRA establishes new rules for a category of “sensitive personal information,” which includes, for example, genetic data and religious or philosophical beliefs, and is defined as personal information that reveals:

(1)

  1. a consumer’s social security, driver’s license, state identification card, or passport number;
  2. a consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
  3. a consumer’s precise geolocation;
  4. a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership;
  5. the contents of a consumer’s mail, email and text messages, unless the business is the intended recipient of the communication; and
  6. a consumer’s genetic data; and

(2)

  1.  the processing of biometric information for the purpose of uniquely identifying a consumer;
  2.  personal information collected and analyzed concerning a consumer’s health; or
  3.  personal information collected and analyzed concerning a consumer’s sex life or sexual orientation.

This definition is among the most impactful changes in the CPRA, given the breadth of data that it sweeps in, along with the creation of new disclosure and opt-out rights associated with “sensitive personal information.” These changes will likely require covered businesses to dive into their data, map it, and ensure they are compliant.

In addition, the CPRA creates a right for consumers to “limit use and disclosure of sensitive personal information.” Similar to existing CCPA opt-out rights, beginning in 2023, consumers may direct businesses that collect sensitive personal information to limit its use to that “which is necessary to perform the services or provide the goods reasonably expected by an average consumer” or to perform a small subset of specifically identified exempt services. Significantly, exemptions to the opt-out will include short-term, transient advertising, and “performing services on behalf of the business,” but not general advertising and marketing, nor long-term profiling or behavioral marketing technologies.
Continue Reading CCPA 2.0? California Adopts Sweeping New Data Privacy Protections

Many experts agree the California public has become immune to the warnings on goods and premises required by Proposition 65, the Safe Drinking Water and Toxic Enforcement Act of 1986. Instead of educating the public, the more notable outcome is a burgeoning cottage industry of plaintiff attorneys bringing frivolous “bounty hunter” enforcement lawsuits against businesses for minor or illusory violations of the statute. As a forthcoming report from the California Attorney General shows, 73 percent of all private settlement payments—totaling $12.7 million—went toward private enforcers’ attorney’s fees and costs in Prop 65 lawsuits settled in 2013. This trend prompted Gov. Brown to declare in May 2013 that Proposition 65 reform was necessary to end these “frivolous shakedown lawsuits.”

In response, California’s Office of Environmental Health Hazard Assessment issued proposed amendments to the regulation on March 7, 2014. Under these notional reforms, businesses operating or selling products in California would need to substantially change their warnings if their products or premises contain certain chemicals listed as “known” carcinogens or reproductive toxicants. OEHHA has claimed — with little support — that these changes will provide “more clarity to the Proposition 65 warning requirements and more specificity regarding the minimum elements for providing a ‘clear and reasonable’ warning for exposures that occur from a consumer product, including foods and exposures that occur in occupational or environmental settings.”

The opposite is likely to occur.


Continue Reading The Questionable Benefits of California’s Prop 65 Reform