As businesses continue their efforts to remain compliant with data privacy laws, the California Privacy Rights Act (CPRA) is an important regulation that professional clients must be aware of. Signed in November 2020, the CPRA builds on and enhances existing consumer privacy law protections that were first established by the California Consumer Privacy Act in 2018. With more robust provisions as it relates to personal data management, processing and sharing, understanding what is required from companies under this new legislation can be challenging for those who are not familiar with its content. This blog post aims to provide a high-level overview of CPRA’s main points, helping readers to become better prepared for change and transition into compliance mode.
Explanation of the California Privacy Rights Act (CPRA)
As privacy concerns continue to grow, the state of California has taken significant steps to protect its residents’ personal information. The California Privacy Rights Act (CPRA) was recently passed to further strengthen data privacy laws in the state. This law expands on the existing California Consumer Privacy Act (CCPA) and bolsters consumers’ privacy rights, including the ability to prevent businesses from selling their personal data. It also sets tougher compliance requirements for companies that collect data and mandates the creation of a new enforcement agency to oversee these regulations. The CPRA is a significant development in the ongoing battle for privacy protection, and businesses operating in California must ensure they are in compliance to avoid severe penalties.
The CPRA takes effect on January 1, 2023, however, government enforcement will not begin until July 1, 2023. The CCPA grants California people the right to know what personal data corporations gather and whether it is sold or given to third parties.
Overview of CPRA provisions and what they mean for businesses
The California Privacy Rights Act (CPRA) has been a hot topic in the business world. The act introduces several new provisions that will impact how businesses collect, store, and protect consumer information. One of the most notable changes is the creation of a new enforcement agency, the California Privacy Protection Agency (CPPA). This agency will have the power to investigate and penalize businesses for noncompliance with the CPRA. Additionally, the act expands on the rights of consumers to access, delete, and correct their personal information held by businesses. Businesses will also be required to disclose more information about their data collection practices and provide an opt-out option for the sale of personal information. Overall, the CPRA signifies a shift towards even stronger consumer privacy protection and greater responsibility for businesses in safeguarding personal information.
Who Needs to Comply with CPRA?
The CPRA applies to all businesses that collect, process or share the personal data of California residents. This includes any business with more than $25 million in annual revenue, those who buy, receive or sell 50,000 or more consumers’ personal information annually, and those who derive 50% or more of their annual revenue from selling such information. Businesses must also comply with the CPRA if they share or disclose information from individuals under 16 years of age. Lastly, any business that collects data from the European Union, regardless of their size and revenue, must comply with the CPRA if it applies to California residents.
What data protection measures should be implemented to comply with the CPRA
As more of our personal information becomes digitized, it’s important to have measures in place to protect that data. This is where the California Consumer Privacy Act (CCPA) comes in. While the CCPA has been in effect since 2020, the California Privacy Rights Act (CPRA) will go into effect in 2023 and will further strengthen data privacy regulations. To comply with the CPRA, companies must implement various data protection measures, such as limiting data collection, creating privacy policies, and responding to consumer requests. These measures will not only protect consumers’ personal information, but also build trust between companies and their clients. Ultimately, data protection is a crucial aspect of modern-day business operations and should be taken seriously by all companies.
How can companies use data responsibly while still adhering to the CPRA requirements
In today’s digital age, companies can gather an abundance of valuable data on customers, employees, and business performance. Yet, with data collection comes the responsibility of respecting individuals’ privacy and complying with regulations. With the newly passed California Privacy Rights Act (CPRA), companies must uphold specific guidelines to ensure data is collected ethically and legally. However, adhering to CPRA requirements does not mean companies cannot utilize data to its full potential. They can still leverage data responsibly by implementing secure data storage methods, anonymizing personal information, and obtaining consent from individuals. By doing so, these companies can strengthen trust with their customers and remain competitive in a data-driven business world.
Sensitive Personal Information as per California Privacy Rights Act (CPRA)
The California Privacy Rights Act (CPRA) defines Sensitive Personal Information as any type of data that is considered to be highly confidential and requires additional security protections. This includes information such as Social Security or driver’s license numbers, biometric and genetic information, health records, geolocation data, Ethnic origin, Religious or philosophical beliefs and financial account numbers. The CPRA also states that companies must provide adequate security measures to protect any Sensitive Personal Information collected. Failure to do so can result in fines and other legal repercussions. Companies should thus ensure they are taking the necessary steps to secure this type of data, such as encrypting it or limiting access to those who need it.
New CPRA Regulation Requirements include
- Residents of California have the right to request that organizations limit the use of their Sensitive Personal Information (SPI).
- Consumers have the right to request rectifications to any inaccurate consumer data records.
- Customers have the option to reject automated decision-making technology.
- Consumers have the right to know the specifics of automated decision-making processes based on their personally identifiable information. All such consumer requests must be honored by organizations.
Other regulatory requirements under CPRA California Privacy Rights Act
- Risk Assessments – To estimate their resilience to compromise, organizations must conduct regular risk assessments of procedures involving sensitive customer data.
- Cybersecurity Audits – Any firm that stores data that could “pose a significant risk to its consumers” if breached is required to conduct independent annual cybersecurity audits and submit them to the CCPA.
Steps businesses can take to ensure compliance with the California Privacy Rights Act (CPRA)
To compliance with the California Privacy Rights Act (CPRA), businesses must take several steps to protect consumer data. These include:
- Creating a comprehensive privacy policy that outlines how personal information is collected, used, and disclosed
- Limiting the collection of unnecessary personal data and only collecting what they need to provide their services
- Ensuring employees are adequately trained on data security and privacy best practices
- Deploy a Risk Assessment Solution
- Obtaining explicit opt-in consent from users before collecting any Sensitive Personal Information
- Storing personal information securely and encrypting it whenever possible
- Third-Party Contracts Should Be Reviewed and Updated
- Responding to consumer requests promptly and accurately.
Potential penalties for non-compliance with the CPRA
The California Privacy Rights Act (CPRA) was passed with the aim of giving Californians more control over their personal data. Organizations that handle this data are expected to comply with the new regulations from January 1, 2023. Failure to do so could invite severe penalties that could harm the reputation and finances of the non-compliant business. Penalties could range from fines worth thousands of dollars to class-action litigation and reputational damage. Any organization that deals with personal data should be aware of the severity of non-compliance with the CPRA. The best course of action is to get ahead of the game and ensure full compliance with the law before it comes into effect.
