October 25, 2021

Volume XI, Number 298


October 22, 2021

Subscribe to Latest Legal News and Analysis

How We Spent Our Summer Vacation or Summary of CCPA Amendments

The long anticipated amendments to the CCPA were passed by the California Legislature in early September and now await Governor Newsom’s signature.  Some of the changes were “clean up” amendments to update cross references, standardize language, and generally address issues of drafting.  What follows is a summary of the most significant and substantive amendments:

  • The CCPA will exempt the collection of personal information from job applicants, employees, business owners, directors, officers, medical staff, or contractors, for one year, provided that the information is collected and used “solely within the person’s role” or former role as a job applicant, etc.  Businesses must still provide a notice to these individuals when personal information is collected.  (1798.145(h))

  • The CCPA includes a new one year exemption related to personal information collected in the business-to-business context. Specifically this exemption provides:

The obligations imposed on businesses by Sections 1798.100, 1798.105, 1798.110, 1798.115, 1798.130, and 1798.135 shall not apply to personal information reflecting a written or verbal communication or a transaction between the business and the consumer, where the consumer is a natural person who is acting as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency and whose communications or transaction with the business occur solely within the context of the business conducting due diligence regarding, providing, or receiving a product or service to or from such company, partnership, sole proprietorship, nonprofit or government agency.  (1798.145(n))

Note that this data is still subject to the “do-not-sell” requirements in Section 1798.120 and the private right of action for data breaches in Section 1798.150.

  • Upon receipt of a consumer request regarding sale of data to third parties, a business must disclose only the category of third parties with whom the information is shared rather than identifying each third party. (1798.115(a))  While the CCPA does not contain a definition of “categories” of third parties, this change eliminates the obligation to identify specific third parties.

  • The definition of personal information has been modified to include a reasonableness standard with respect to the prong of the definition that states that information that is capable of being associated with a particular consumer or household is personal information. That is, “Personal information means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.  Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household”.  (1798.140(o)(1))

  • The amendments clarify the carve-out from the definition of “personal information” for “publicly available” information by deleting the difficult-to-apply standard that required interpretation of the “purpose” for which records were released by the government. (1798.140(o)(2))

  • The Fair Credit Reporting Act (FCRA) exemption has been expanded to cover FCRA data rather than just data furnished to consumer reporting agencies for an FCRA purpose. (1798.145(d))

  • A new exemption was created for vehicle information or ownership information if such information is shared for the purpose of effectuating, or in anticipation of effectuating, a vehicle repair covered by a vehicle warranty or a recall conducted pursuant to Sections 30118 to 30120, inclusive of Title 49 of the United States Code, provided that the vehicle dealer or manufacturer with whom the information is shared does not sell, share, or use that information for any other purpose.  (1798.145(g))

  • The consumer’s right not to be subject to discrimination removes the difficult-to-apply requirement that incentives be related to the value of consumer data to the consumer and replaces it with the value to the business (1798.125). There are parallel and conforming changes made elsewhere in this amended section.

  • The section addressing the mechanisms for consumers to exercise their rights has been clarified in two ways. First, a business that operates exclusively online and has a direct relationship with a consumer is required to provide only an email address for the consumer to submit requests.  Second, businesses that maintain an internet website must make the website available to consumers to submit their requests.  (1798.130(a)).  For businesses with a brick and mortar facility, a toll free number will continue to be required.  In addition, this section also provides that a business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested and that if the consumer maintains an account, the business may require the consumer to submit the request through that account.

  • The consumer access provision makes clear that a consumer has the right to request the specific pieces of personal information a business has collected about the consumer. (1798.110(c).)  This change clarifies a consumer’s right to request specific pieces of information and a business’s requirement to disclose such information upon request.

  • The private right of action has been narrowed by clarifying that information that is either encrypted or redacted is outside the scope of the right to sue for data breaches. (1798.150(a))

In addition to waiting for the California Governor’s signature on these amendments, the business community eagerly awaits Attorney General proposed regulations addressing what qualifies as a “verifiable consumer request” and requirements for do-not-sell mechanisms.  It will be a busy fall.

Amendments to the CCPA from Drinker Biddle & Reath LLP on Vimeo.

© 2021 Faegre Drinker Biddle & Reath LLP. All Rights Reserved.National Law Review, Volume IX, Number 262

About this Author

Peter A. Blenkinsop DC Healthcare, Pharma, LifeSciences, Enterprise Blockchain ,Privacy, Security, Clinical Research,Government and Reg Affairs

Peter A. Blenkinsop advises clients on data privacy, research compliance, and e-health. He co-chairs the firm’s Information Privacy, Security & Governance practice. Peter represents clients in the life sciences, health, nutrition, and technology sectors, among others.

Peter’s focus on data privacy and security law began well over a decade ago in the run up to implementation of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Since then, his practice has expanded well beyond health information privacy to data privacy and security...

Katherine Armstrong, Drinker Biddle Law Firm, Washington DC, Data Privacy Attorney

Katherine E. Armstrong is counsel in the firm’s Government & Regulatory Affairs Practice Group where she focuses her practice on data privacy issues, including law enforcement investigations, and research and analysis of big data information practices including data broker issues.

Katherine has more than 30 years of consumer protection experience at the Federal Trade Commission (FTC), where she served in a variety of roles, including most recently as a Senior Attorney in the Division of Privacy and Identity Protection.  In the Division of...

Reed Abrahamson Faegre Drinker Biddle

As a member of the firm’s Privacy and Cybersecurity Team, Reed Abrahamson assists clients with identifying and addressing data privacy and security risks in business operations. A Certified Information Privacy Professional - United States (CIPP-US), he helps companies design and implement privacy and data security policies and programs, and advises clients on compliance issues related to the GDPR, CCPA, HIPAA, CAN-SPAM Act, TCPA, and other privacy laws. Reed also has experience working with companies to respond to data breach incidents.

Reed counsels clients on managing risk through...