Dechert LLP

11/12/2020 | Press release | Distributed by Public on 11/12/2020 15:47

The Past as Prologue: California Voters Approve CPRA as AG Proposes...

On November 3, 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA). Crafted to address perceived gaps in the California Consumer Privacy Act (CCPA) including through various amendments, the CPRA effectively calcifies the law by barring most changes to the CCPA. For now, companies subject to the CCPA must grapple with the impact of the CCPA and recently proposed regulations (Proposed Regulations) issued by the California Attorney General (CA AG). The CPRA will become effective five days after the California Secretary of State certifies the election results (Effective Date), and while the law will apply to personal information collected on or after January 1, 2022, most provisions become enforceable on January 1, 2023, amendments to the CCPA will be enforceable on July 1, 2023.

The CPRA aligns the CCPA even more closely with the EU General Data Protection Regulation (GDPR), granting GDPR privacy rights to California consumers and imposing new obligations on companies - for example, requiring service providers to assist 'businesses' to comply with their CCPA obligations - a requirement for processors under the GDPR.

Companies will welcome some changes, including extension of the employee and 'B2B' exemptions and exclusion of certain information from the definition of personal information. Many other aspects of the CPRA, however, could force companies to upend their CCPA compliance programs, on which they have already spent significant resources. The ad tech industry appears to be particularly in the line of fire. All companies in the advertising ecosystem, including back end providers of data driven products and services, will have to carefully assess their business models in light of the CPRA's changes and adapt their CCPA compliance strategies as needed.

The impact of the CPRA could be accelerated by the current rulemaking process for the Proposed Regulations, which, in turn, could facilitate more orderly integration of the two regimes and their shared policy goals. Now is the time to start planning and budgeting for the impending changes.

In Section I, this Dechert OnPoint summarizes the main provisions of the CPRA. Section II provides a brief overview of key provisions of the Proposed Regulations and offers takeaways for companies navigating California's increasingly complex privacy regime.