October 25, 2021

Volume XI, Number 298

Advertisement
Advertisement

October 25, 2021

Subscribe to Latest Legal News and Analysis

California’s New Privacy Agency Seeks Feedback on CPRA

California’s new privacy protection agency recently issued an invitation for public comments as part of its preliminary rulemaking activities for the California Privacy Rights Act (CPRA). Introduced and passed by ballot initiative in November 2020, CPRA amends and introduces several new concepts to CCPA.

CRPA required the creation of a new administrative entity – the California Privacy Protection Agency (CCPA) – tasked with implementing and enforcing the law separate from the attorney general’s office. Appointed in March, the agency’s five-member board is made up of lawyers and academics.  In advance of the January 1, 2023 effective date, the agency seeks comments on both the new CPRA rules, as well updates to CCPA’s existing rules. While the agency is supposed to issue final CPRA regulations by July 1, 2022 (before the amended law goes into effect), many are skeptical of this timing in light of the process and timing for the CCPA regulations.

In particular, the Agency seeks feedback on the “new and undecided” issues introduced by CPRA, including:

  • Processing that presents a significant risks to consumers’ privacy or security

  • Cybersecurity audits and risk assessments

  • Automated decision-making

  • Rights to delete, correct, and to know

  • Right to opt-out of selling or sharing of personal information

  • Right to limit use and disclosure of sensitive personal information

  • Definitions such as “sensitive personal information” and “deidentified” (among others)

Putting it into Practice. Comments are due by November 8, 2021. Tips for submitting effective comments are available here. Public hearings are expected to be heard in Winter/Spring of 2021 – 2022. This invitation for comments is not the same as a proposed rulemaking action. The public will have the opportunity to provide additional comments on proposed regulations or modifications when the agency proceeds with a notice of proposed rulemaking action (expected later this year). The agency’s next board meeting is scheduled for October 18, 2021 at which time we may learn other additional information about this process and expected timelines.

Copyright © 2021, Sheppard Mullin Richter & Hampton LLP.National Law Review, Volume XI, Number 271
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

Julia Kadish is an attorney in the Intellectual Property Practice Group in the firm's Chicago office.

Areas of Practice

Julia's practice focuses on data breach response and preparedness, reviewing clients' products and services for privacy implications, drafting online terms and conditions and privacy policies, and advising clients on cross-border data transfers and compliance with US and international privacy regulations and standards. She also workes on drafting and negotiating software licenses, data security exhibits, big data licenses, professional...

312.499.6334
Advertisement
Advertisement
Advertisement