April 23, 2021

Volume XI, Number 113

Advertisement

April 22, 2021

Subscribe to Latest Legal News and Analysis

April 21, 2021

Subscribe to Latest Legal News and Analysis

April 20, 2021

Subscribe to Latest Legal News and Analysis

CCPA: When “Final” Doesn’t Mean What You Think It Means (with apologies to The Princess Bride)

Earlier this week, the California Department of Justice unexpectedly released a third set of proposed modifications to the CCPA regulations. This move took place only two months after the California Attorney General’s Office “finalized” the long-awaited CCPA regulations. The latest changes relate to offline notices, “Do Not Sell My Personal Information” opt-out requests, authorized agent requests, and children’s information, as discussed below.

As a reminder, the Department initially published its proposed regulations almost exactly a year ago, on October 12, 2019. It then devoted a large part of 2020 to collecting public comments, carefully considering them, and releasing several sets of modifications to its proposed regulations in February and March of 2020.

The Office of Administrative Law (OAL) then approved the modified regulations, and the regulations became final on August 14, 2020, as discussed in our August blog post. And, as we reported in greater detail last month, those Final Regulations included key deleted and new additional provisions, which had an immediate impact on businesses and their CCPA compliance obligations for the duration of 2020 and beyond.

Here are the latest key changes the AG’s office is now considering:

  1. Offline Collection Notice:  Proposed section 999.306(b)(3) now offers examples of how businesses that collect personal information while interacting with their consumers offline can provide the notice of their right to opt-out of the sale of personal information through an offline method. 
  2. Opt-Out Requests:  Proposed section 999.315(h) now offers examples and further guidance on how a business’s methods for consumers submitting requests to opt-out should require only minimal steps. It also instructs businesses not to use confusing language, such as double negatives; not to collect more PI than necessary; and not to require consumers to click through or listen to reasons why they should not opt out (with some exceptions).
  3. Authorized Agent Requests:  Proposed section 999.326(a) clarifies that businesses may require an authorized agent to provide proof and may require a consumer to verify their request.
  4. Children’s Information:  Proposed section 999.332(a) includes a grammatical change, which clarifies that businesses subject to section 999.330 and/or 999.331 must include a description of the processes set forth in those sections in their privacy policies.

The AG’s deadline to submit written comments is October 28, 2020. A full text of the proposed changes can be found here. Businesses should carefully consider the latest set of modifications in deciding whether to comment and how these latest proposed changes impact their CCPA obligations moving forward. Meanwhile, we will continue to monitor and share with our readers any additional changes to the regulations and other CCPA-related developments.

Advertisement
©1994-2021 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.National Law Review, Volume X, Number 288
Advertisement
Advertisement

TRENDING LEGAL ANALYSIS

Advertisement
Advertisement

About this Author

Cynthia Larose, Privacy, Security, Attorney, Mintz Levin, Law Firm, electronic transactions lawyer
Member / Chair, Privacy & Cybersecurity Practice

Cynthia is a highly regarded authority in the privacy and security field and a Certified Information Privacy Professional (CIPP). She handles the full range of data security issues for companies of all sizes, from start-ups to major corporations. Cynthia is masterful at conducting privacy audits; crafting procedures to protect data; advising clients on state, federal, and international laws and regulations on information use and data security; helping organizations respond to breaches; and planning data transfers associated with corporate transactions. She is an in-...

617-348-1732
Natalie Prescott, Mintz Levin Law Firm, Litigation Attorney
Practice Group Associate

Natalie’s practice focuses on a wide range of litigation matters.

Prior to joining the firm, Natalie worked as the co-founder and trial lawyer for a boutique litigation firm that focuses on state and federal litigation. She also spent many years as a litigation associate at one of the world’s largest law firms, where she received extensive consumer litigation, trial, and appellate experience.

Previously, Natalie served as a judicial law clerk for the Honorable Roger T. Benitez of the United States District Court of the...

858 -314-1534
Advertisement
Advertisement