California Privacy Rights Act – A New Privacy Law Potentially to be Adopted in California.
2024-09-27 01:02:22
Just days before the California Consumer Privacy Act ("CCPA") took effect on July 1, 2020, a new initiative, the California Privacy Rights Act ("CPRA"), gathered enough signatures to qualify for the November ballot this year. If passed, this new initiative would impose stricter requirements on businesses to protect consumer privacy. Here are some notable key provisions of the new initiative:
Effective Date. According to a recent poll, the new initiative is highly likely to be passed. If adopted, it would take effect on January 1, 2023, with most provisions applying to personal information collected from January 1, 2022.
New Protections for "Sensitive Personal Information." The new initiative would broadly define "sensitive data," including government-issued identifiers for individuals, financial account information, precise geolocation, racial or ethnic origin, religious beliefs, the contents of certain categories of information, and genetic, biometric, health, and some private information. Under the new initiative, consumers would have the right to limit businesses' use, sharing, and selling of such information to authorized purposes only.
Expanded Data Breach Liability. If a business fails to maintain reasonable data security, the currently enforced CCPA grants consumers a private right of action for breaches of unencrypted, unredacted personal information. The new initiative would grant consumers a private right of action for breaches of email addresses and passwords, or email addresses and security questions.
New Audit and Risk Assessment Requirements. Businesses whose data processing poses significant risks to consumer privacy or data security would need to conduct annual cybersecurity audits and periodic risk assessments.
Restrictions on the Use of Automated Decision-Making Technology. Consumers would have the right to know and opt-out of businesses' use of automated decision-making technology, including profiling.
Limits on Data Retention Periods. The new initiative would require businesses to inform consumers of the intended retention period for each category of personal information.