September 23, 2018

September 21, 2018

Subscribe to Latest Legal News and Analysis

September 20, 2018

Subscribe to Latest Legal News and Analysis

California Legislature Passes Amendments to the California Consumer Privacy Act

The California Consumer Privacy Act (CCPA) is a major new state law poised to affect the privacy landscape not just in California, but in the U.S. as a whole. (For a detailed overview of the CCPA, read our previous post.) On August 31, the California legislature passed several amendments to the CCPA that will have a significant impact on its implementation. The amendments, which are set out in Senate Bill 1121, may be summarized as follows:

Changes to Effective and Enforcement Dates. As originally drafted, the CCPA was set to become operative on January 1, 2020, and SB 1121 preserves this operative date. However, the bill clarifies that the CCPA will go into effect immediately upon the bill being signed into law in order to prevent California localities from passing conflicting laws prior to the January 1, 2020 operative date. Practically speaking, this means that although the CCPA will go “into effect” and become California state law immediately, its directives still will not become operative until January 1, 2020.

That being said, the California Attorney General will not necessarily be able to enforce the law until after January 1, 2020, as the bill also changes the date by which the Attorney General is expected to publish implementing regulations. The CCPA requires the Attorney General to adopt implementing regulations meant to “further the purpose” of the law and may, for example, update the categories of data considered to be “personal information” under the law in order to address changes in technology; establish exceptions required to comply with state or federal law; and set out rules and procedures governing businesses’ compliance with consumers’ opt-out requests. SB1121 pushes the date by which the Attorney General must publish those regulations by six months, from January 1, 2020 to July 2, 2020. Additionally, the bill precludes the AG from bringing a CCPA enforcement action until six months after the publication of the final regulations or July 1, 2020, whichever is sooner. This may give companies some lead time to ensure that they are in compliance with the regulations, depending on when those regulations are published.

Elimination of a Notification Requirement. The CCPA provides a private right of action, meaning it allows individuals to pursue their own lawsuits (rather than wait for a regulatory enforcement action) in instances where company suffers a data breach attributable to the company’s failure to implement reasonable security measures. The CCPA originally required consumers pursuing a private action to notify the Attorney General within 30 days of filing that action. The law then gave the Attorney General 30 days to take one of three actions: notifying the consumer of the AG’s intent to pursue the action, instructing the consumer not to proceed with the action, or ignoring the notification (which would allow the consumer to proceed). However, the bill eliminates a consumer’s duty to notify the AG. A consumer is still required to notify a business of any violations he or she detects 30 days before initiating an action against the company.

Clarifications as to Entities Exempted from the CCPA. Certain companies subject to other privacy requirements in the federal Gramm-Leach-Bliley Act, the federal Health Insurance Portability and Accountability Act, the California Financial Information Privacy Act, and other sector-specific laws initially were concerned that CCPA could impose conflicting requirements on them. The bill clarifies that data handled pursuant to, and covered entities subject to, certain specific laws – specifically the Gramm-Leach-Bliley Act, the Driver’s Privacy Protection Act, and the California Financial Information Privacy Act – are not subject to the CCPA. The bill also clarifies that some clinical trials, and healthcare providers covered by the Confidentiality of Medical Information Act – a California state law that supplements HIPAA privacy requirements – do not need to comply with the CCPA. However, in some of these cases, CCPA’s narrow private right of action is still available.

As of the time of writing, SB1121 is sitting on Governor Brown’s desk awaiting signature, meaning it has not yet become law. Assuming the bill becomes law, additional amendments still may be forthcoming between now and the time the CCPA becomes enforceable.

© 2018 Proskauer Rose LLP.

TRENDING LEGAL ANALYSIS


About this Author

Courtney M Bowman, Litigation Attorney, Proskauer, Law Firm
Associate

Courtney Bowman is an associate in the Litigation Department. She assists clients in a wide variety of industries with issues related to privacy, data security and general commercial litigation. Courtney has helped clients develop and implement global privacy programs, has assisted clients in legalizing cross-border data transfers and regularly collaborates with her colleagues in Proskauer’s international offices, as well as local counsel, to counsel clients on compliance with data protection laws and regulations in the EU, including becoming compliant with the General...

310-284-4584
Kristen J Mathews, Privacy, Data Security Attorney, Proskauer, Law Firm
Partner

Kristen J. Mathews is head of the Privacy & Data Security Group and a member of the Technology, Media & Communications Group.

Kristen focuses her practice on technology, e-commerce and media-related transactions and advice, with concentrations in the areas of data privacy, data security, direct marketing and online advertising. She regularly advises clients on a wide range of matters, including privacy and data security compliance, customer authentication, responding to data security breach incidents, preparing privacy and data security policies, data profiling, behavioral marketing, open source software issues, financial privacy, children’s privacy, international privacy, health care privacy, identity theft prevention, geolocational privacy, mobile marketing, social networking, payment card data security and telematics.

212-969-3265