On August 14, California Attorney General Xavier Becerra announced that the Office of Administrative Law (OAL) had approved the regulations for the California Consumer Privacy Act (CCPA) and filed the regulations with the California Secretary of State. The regulations take effect immediately.
The August 14 regulations were also accompanied by an Addendum to the Final Statement of Reasons. The Attorney General made "non-substantive" changes to the final regulations for "accuracy, consistency, and clarity."
While the Attorney General described its changes as "non-substantive," several notable provisions were withdrawn. These are:
- Section 999.305(a)(5), which required
affirmative opt-in for a material change to how a business uses
personal information.
- Section 999.306(b)(2), which required
the provision of an offline notice of opt-out right where a
business substantially interacts offline with a consumer.
- Section 999.315(c), which required
that methods for opt-out be easy to execute.
- Section 999.326(c), which allowed a business to deny an authorized agent request if the agent did not submit proof of their authority to act for the consumer.
The Addendum to the Final Statement of Reasons allows for those four withdrawn provisions to be resubmitted by the Attorney General after further review and possible revision. Article 7 regarding severability was also "deleted as unnecessary."
Enforcement of the CCPA began on July 1, 2020, and companies should be aware that the Attorney General has reportedly already begun to send out notices of non-compliance. With the final regulations now in place, companies have guidance on compliance with the CCPA. However, as the California Privacy Rights Act (CPRA) will now appear on California's November 2020 ballot, it is possible that companies may be faced with entirely new requirements, some as early as next year.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
