The California Consumer Privacy Act (CCPA), the most comprehensive U.S. privacy laws to date, is set to come into force on January 1, 2020.
Yet, the laws are far from final. The California State Legislature, realizing the clock is ticking fast, returned after its summer recess to work on CCPA pending amendments. It now only has until September 13, 2019, to send any amendments to the Governor Gavin Newsom’s desk for signature. The Governor will then have until October 13, 2019, to act on the amendments.
As of the August 12, 2019 hearing of the Senate Appropriations Committee, six amendments appeared to be removed from the agenda to head straight to the Senate floor for a vote. The 6 amendments are the following:
AB-25 carves out certain employment related information from the definition of “consumer” under the CCPA.
AB-846 clarifies the non-discrimination provision that CCPA does not prohibit a business from offering different prices or quality of goods or services if the offering is in connection with a consumer’s voluntary participation in a loyalty or rewards program or the like. However, it prohibits a business from “selling” (in the CCPA context) the personal information collected as part of such program.
AB-874 clarifies that deidentified or aggregate consumer information is not “personal information” under the CCPA. It also excludes “publicly available,” namely “information that is lawfully made available from federal, state, or local government records,” from the definition of “personal information.”
AB-1146 excludes from the CCPA right of deletion any personal information necessary to fulfill the terms for warranty or product recall purposes in accordance with federal law. It also clarifies that the CCPA right to opt out of sale does not apply to the vehicle or ownership information between a vehicle dealer and the manufacturer if the sharing is for warranty repair or recall purposes.
AB-1355 clarifies, among others, that a consumer has the right to request specific pieces of personal information and that this must be disclosed on a business privacy policy.
AB-1564 adds an exception for a business that “operates exclusively online and has a direct relationship with a consumer from whom it collects personal information” to only provide an email address to allow consumers to submit requests to exercise various CCPA rights. Other businesses must make available “two or more designated methods” for requests submission that would include a toll-free telephone number at a minimum. If a business has a website, such website must be available for consumers to submits requests.
Further to any of the amendments that will be signed into law, it is important to note that the California Attorney General will issue proposed regulations to clarify any ambiguities in the CCPA. Final regulations will also govern how one must comply with the CCPA.
