(714) 997-4400
Final Proposed Regulations Package
On June 1, 2020, the Office of the California Attorney General submitted the final proposed regulations package under the California Consumer Privacy Act (CCPA) to the California Office of Administrative Law (OAL). OAL has 30 working days, plus an additional 60 calendar days under Executive Order N-40-20 related to the COVID-19 pandemic, to review the package for procedural compliance with the Administrative Procedure Act. Once approved by the OAL, the final regulation text will be filed with the Secretary of State and become enforceable by law.
CCPA was signed into law on June 28, 2018, and went into effect on January 1, 2020. CCPA grants California consumers robust data privacy rights and control over their personal information, including the right to know, the right to delete, and the right to opt out of the sale of personal information that businesses collect, as well as additional protections for minors.
Data Privacy More Important Now
Attorney General Xavier Becerra said, when submitting the package:
“As our lives increasingly move online, our data privacy becomes more important than ever. The California Consumer Privacy Act, which gives consumers choice and control over personal information in the marketplace, is game-changing and historic. Our regulations provide businesses and individuals with guidance on how to protect that choice and boost transparency, while continuing to unleash innovation. Businesses have had since January 1 to comply with the law, and we are committed to enforcing it starting July 1.”
The CCPA has been amended several times, on September 23, 2018 by SB 1121 and on October 11, 2019 by AB 25, AB 874, AB 1146, AB 1355, and AB 1564, since being signed into law. The regulations establish procedures for compliance and exercise of rights, as well as clarifying important transparency and accountability mechanisms for businesses subject to the law.
Regulations for Businesses Collecting Information
Notices within the CCPA for businesses that collect personal information from consumers include:
When a business collects personal information from a consumer’s mobile device for a purpose that the consumer would not reasonably expect, it shall provide a just-in-time notice containing a summary of the categories of personal information being collected and a link to the full notice at collection. For example, if the business offers a flashlight application and the application collects geolocation information, the business shall provide a just-in-time notice, such as through a pop-up window when the consumer opens the application, which contains the information required by this subsection.
A business shall not use a consumer’s personal information for a purpose materially different than those disclosed in the notice at collection. If the business seeks to use a consumer’s previously collected personal information for a purpose materially different than what was previously disclosed to the consumer in the notice at collection, the business shall directly notify the consumer of this new use and obtain explicit consent from the consumer to use it for this new purpose.
A business shall not collect categories of personal information other than those disclosed in the notice at collection. If the business intends to collect additional categories of personal information, the business shall provide a new notice at collection.
If a business does not give the notice at collection to the consumer at or before the point of collection of their personal information, the business shall not collect personal information from the consumer.
The business must provide notice about collecting information to the consumer. When a business collects consumers’ personal information online, it may post a conspicuous link to the notice on the introductory page of the business’s website and on all webpages where personal information is collected.
When a business collects personal information through a mobile application, it may provide a link to the notice on the mobile application’s download page and within the application, such as through the application’s settings menu.
When a business collects consumers’ personal information offline, it may include the notice on printed forms that collect personal information, provide the consumer with a paper version of the notice, or post prominent signage directing consumers to where the notice can be found online.
When a business collects personal information over the telephone or in person, it may provide the notice orally.
Orange County Criminal Defense Attorney
At the Law Office of Ronald G. Brower, we specialize in many areas of the law, from aggravated-assault to white-collar crimes. If you are facing criminal charges, then please reach out to Attorney Brower for a consultation. With more than three decades of experience, he has the expertise to advocate for you effectively.