Final CCPA Proposed Regulations Submitted

The final proposed regulations for the California Consumer Privacy Act (CCPA) were submitted by the California Attorney General to the California Office of Administrative Law earlier this month. The proposed regulations aim to further clarify compliance measures for businesses serving California residents.

The CCPA, which went into effect January 2020, is a regulatory step toward giving California consumers control over how their personal information is collected, used, and shared.

A brief outline of the CCPA:

• California consumers have the power to demand companies disclose what personal data they have.
• Businesses can no longer commodify consumer data.
• Organizations are required to ask for opt-in consent when collecting consumer information. 
• Businesses are required to explain why they possess certain data and what security measures are in place.
• California consumers can ask companies to delete data and file class actions when companies fail to comply.

The final proposed regulations do not deviate from modified regulations released in March and include more definitive definitions of categories such as “third-party.” A final report outlining the reasons for any changes was published by Attorney General Xavier Becerra.

Enforcement of the CCPA is still scheduled to begin July 1. The OAL has 30 business days to respond to the proposed regulations, with an extra 60 days added due to time constraints resulting from the COVID-19 crisis. Before submitting the final proposal, seven public forums and four public hearings were held during a comment period.

An additional measure, the California Consumer Rights Act (CPRA) which extends consumer rights and further clarifies enforcement standards will be on the November ballot for voters. In addition to additional protections, the CPRA seeks to establish a privacy enforcement arm called the California Consumer Protection Agency.