Troutman Sanders LLP reports on modifications to the California Consumer Privacy Act.
9/30/2019 9:00
“Over the past year, nearly 20 amendments were introduced to modify the California Consumer Privacy Act of 2018 (“CCPA”). Now that the deadline to introduce new amendments has passed, we can start to visualize what the CCPA will look like in its effective form. Despite many attempts to dramatically modify the scope, application, and enforcement authority of the CCPA, for the most part, the CCPA will remain the same. However, many of the changes that will likely take effect, subject to the governor’s approval, will impact organizations’ CCPA compliance efforts.
The following is a recap of the amendments that are likely to be signed into law, along with comments stemming from the legislative history for context. Note that the section headings provided below do not appear in the official text of the bills but are added here in this discussion for ease of reference. For those interested in learning more about the bills that did not make it out of the legislature, Troutman Sanders is finalizing its CCPA Amendments Monitor, which will provide a thorough review of all CCPA amendments that have passed and failed to date.
AB 25 – Personal Information Collected in the Employment Context
- Temporarily excludes, until Jan. 1, 2021, personal information collected in the employment context from the scope of the CCPA, except with respect to the CCPA’s private right of action relating to data breaches and notice obligations pursuant to Section 1798.100.
- The private right of action (breach) and notice obligations under Section 1798.100 will continue to take effect on Jan. 1, 2020 with respect to personal information collected in the employment context (and personal information collected otherwise).
- Expressly specifies an exemption for PI collected and used solely for emergency contact purposes and where the PI is necessary to be retained for the administration of benefits.
- Clarifies the authority that a business has to require reasonable authentication of a consumer and to use existing account of consumers to convey CCPA requests.
Notably, as provided in the bill’s legislative history, the one-year sunset period is intended to provide the Legislature time to more broadly consider what privacy protections should apply in employment-based contexts and whether to repeal, revise, and/or make the exemptions permanent in whole or in part in moving forward.
AB 874 – Redefining PI and ‘Publicly Available’ Information
- Expands the scope of ‘publicly available’ information that is exempted from the PI definition to ensure that ‘publicly available’ includes any information that is lawfully made available from government records. In other words, it removes the conditions previously associated with ‘publicly available’ information.
- Amends the PI definition to: (1) correct a drafting error in order to clarify that PI (as opposed to ‘publicly available’ information) does not include deidentified or aggregate consumer information; and (2) specifies, in relevant part, that PI includes information that is ‘reasonably capable’ of being associated with a particular consumer or household, as opposed to ‘capable’ of being associated.
According to the authors, the limitation previously imposed on ‘publicly available’ was ‘confusing and unworkable.’ The authors indicated that it is unlikely that businesses would be able to determine the purpose for which a government entity made information available to the public. Even assuming a business could ascertain this rationale, the authors found it unlikely that there would be any instances where a business would be deemed to use such information for the same purpose that the government made it public.”
Read more on the CCPA amendments in the article from Troutman Sanders LLP Associate Sadia Mirza and Partner Ronald I. Raether Jr.
Editor’s note: This content is published with permission from Troutman Sanders LLP. If you are interested in sharing articles and analysis on legal cases, industry laws and regulations or other relevant topics for possible publication with ACA International, email our Communications Department at [email protected].