Signatures Submitted for a New Privacy Initiative on the November Ballot
Tuesday, May 19, 2020
On May 4, Californians for Consumer Privacy, the group behind the California Consumer Privacy Act (CCPA) announced that it had submitted enough signatures are valid to put its new initiative, the California Privacy Rights Act of 2020 (CPRA), on the November ballot. Signatures need to be certified by election officials by June 25th. Before then the initiative can still be withdrawn. The new law would strengthen and expand the California Consumer Privacy Act that was adopted by the Legislature in 2018 in a deal designed to prevent a proposed initiative from appearing on the ballot.
The new initiative originally submitted to the Attorney General in October of 2019 has since been renamed and amended by the sponsors. If adopted by the voters it will become effective on January 1, 2023 and apply to personal information collected after January 1, 2022. The CPRA is very comprehensive and what follows are just a few selected highlights. The initiative would:
- Create a new California Privacy Protection Agency.
- Creates a new category of “Sensitive Personal Information.”
- Reduce the scope of businesses covered.
- Address not just selling, but also sharing, personal information.
- Grant consumers the right to limit the use of sensitive data for any secondary purpose and require businesses to provide a link titled “Limit the Use of My Sensitive Personal Information”
- Requires the Attorney General to adopt regulations requiring certain businesses to perform annual privacy and data security audits.
- Expands the exemption that applies to “publicly available information” by redefining such information.
- Makes personal Information exempt if it is collected, processed, sold, or disclosed subject to (the phase now in law is pursuant to) the federal Gramm-Leach-Bliley Act (Public Law 106-102), and implementing regulations, or the California Financial Information Privacy Act (Division 1.4 (commencing with Section 4050) of the Financial Code),
- Gives authority to the Attorney General to adopt regulations regarding insurance by having the Attorney General review existing California Insurance Code provisions and regulations relating to consumer privacy, except those relating to insurance rates or pricing, to determine whether any provisions of the Insurance Code provide greater protection to consumer than the provision of the new law and, upon completing his review the Agency (perhaps this reference should have been to the Attorney General) shall adopt regulations that applies only the more protective provisions of the new law to insurance companies.