- 1798.100 – Consumers right to receive information on privacy practices and access information
- 1798.105 – Consumers right to deletion
- 1798.110 – Information required to be provided as part of an access request
- 1798.115 – Consumers right to receive information about onward disclosures
- 1798.120 – Consumer right to prohibit the sale of their information
- 1798.125 – Price discrimination based upon the exercise of the opt-out right
Amendments
Amendments
Summary of the Amendments to the CCPA
|
Date Enacted |
2018-08-311 |
|
Bill Number |
|
|
Subject |
Introduced additional exemptions |
|
Business Impact |
Improvement |
|
Description |
The amendment introduced, and/or expanded, a series of exemptions to the CCPA including: · A partial exemption for financial institutions regulated by the Gramm Leach Bliley Act, · An exemption for data collected pursuant to the Driver’s Privacy Protection Act, · An exemption for information governed by the Health Insurance Portability and Accountability Act. The amendment further clarified that conflicting federal and state laws trump the CCPA. The amendment removed the requirement that a plaintiff need inform the Attorney General prior to bringing suit. The bill clarified the limited scope of the private right of action. The bill limited the civil penalty that could be sought by the Attorney General. The bill revised timelines concerning regulations to be promulgated by the Attorney General. |
|
Date Enacted |
2019-09-122 |
|
Bill Number |
|
|
Subject |
Modifies definitions including definition of “personal information” |
|
Business Impact |
Marginal Improvement |
|
Description |
The amendment modified the definition of “personal information” to (i) add the term “reasonably” to the requirement that “personal information” be capable of being associated with or linked to an individual or household, both generally and in reference to a particular enumerated category; (ii) amend an exception to the definition of “personal information” for publicly available information by removing certain conditions on the exception related to “compatible” uses of data; and (iii) exempt aggregate and deidentified consumer information from the definition of personal information. The amendment further confirmed that “deidentified or aggregate consumer information” is exempt from the definition of “personal information.” Both “aggregate consumer information” and “deidentified” are separately defined in section 1798.140. Finally, the amendment made a number of non-substantive technical changes to various definitions in section 1798.140. |
|
Date Enacted |
2019-09-123 |
|
Bill Number |
|
|
Subject |
Creates a narrow exception that allows new motor vehicle dealers to share vehicle and vehicle ownership information with the original manufacturer for the exclusive purposes of warranty or recall-related repairs. |
|
Business Impact |
Improvement |
|
Description |
The amendment creates an exception to the consumer opt-out right and gives new motor vehicle dealers the ability to share vehicle information and vehicle ownership information with the original manufacturer of the vehicle. This exception may only be exercised for the purposes of anticipating or carrying out a warranty or recall-related repair. The exception is limited to “new motor vehicle dealers” which include dealers that acquire for resale (1) new and unregistered motor vehicles, (2) new off-highways motorcycles, or (3) new off-highway all-terrain vehicles. Although used car dealers are not covered, used cars sold by a new motor vehicle dealer are not excluded. |
|
Date Enacted |
2019-09-134 |
|
Bill Number |
|
|
Subject |
Delays effective date until 1.1.2021 for “personal information” collected in the context of employment relationships for most requirements of the statute |
|
Business Impact |
Significant Improvement |
|
Description |
The amendment delays the effective date until January 1, 2021 of many requirements of the statute for personal information collected by the business from job applicants, employees, owners, directors, officers, medical staff members, or contractors (collectively referred to as “employees” for purposes of this summary) provided the information (i) is used solely within the contexts of those roles and (ii) is necessary for the administration of benefits. Section 1798.145(g) The amendment does not delay the effective date when a business must notify employees of the business’s privacy practices. Specifically a business must still notify an “employee” “at or before the point of collection of categories of personal information to be collected and the purposes for which the categories of personal information will be used.” Section 1798.100(b). Once notification to the employee is provided, a business cannot expand the categories of personal information collected about the individual without their consent. Section 1798.100(b) The amendment does not delay an employee’s right to sue in the event of a data breach involving their unencrypted or un-redacted information. Section 1798.150. |
|
Date Enacted |
2019-09-135 |
|
Bill Number |
|
|
Subject |
Financial incentive programs |
|
Business Impact |
Marginal Improvement |
|
Description |
The amendment allows a business to treat consumers differently depending upon whether they exercise a privacy right, if the differential treatment is reasonably related to the value provided to the business by the consumer’s data. The amendment clarified some of the ambiguous language contained in the original version of the CCPA around the private right of action. The amendment expands and clarifies the exemption provided to consumer reporting agencies that are governed by the Fair Credit Reporting Act. The amendment temporarily delays the application of the CCPA to information collected from some business contacts. The amendment further clarifies that de-identified or aggregated information is exempt. |
|
Date Enacted |
2019-09-146 |
|
Bill Number |
|
|
Subject |
Requires “data brokers” to register with the Attorney General’s office |
|
Business Impact |
Marginal Detriment |
|
Description |
The bill requires “data brokers,” a term which is defined to include companies that sell personal information and do not have a direct relationship with a consumer, to register and pay a fee with the Attorney General. The Attorney General will in turn create an online directory of the registered data brokers. |
|
Date Enacted |
2019-09-127 |
|
Bill Number |
|
|
Subject |
Methods for Submission of Consumer Requests |
|
Business Impact |
Marginal Improvement |
|
Description |
The amendment clarifies that a business that “operates exclusively online and has a direct relationship with a consumer from whom it collect personal information” is required to provide only an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115. The amendment adds that where a business maintains a website, the business must make the website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115. |
1. Approved by the Governor on September 23, 2018.
2. Pending approval by the Governor.
3. Pending approval by the Governor.
4. Pending approval by the Governor.
5. Pending approval by the Governor.
6. Pending approval by the Governor.
7. Pending approval by the Governor.