California Attorney General (AG) Xavier Becerra released draft regulations for the California Consumer Privacy Act (CCPA) on October 10. The CCPA, which was enacted in 2018 and goes into effect on January 1, 2020, creates broad new rights for California consumers with respect to their personal information. Among other things, California consumers have the right to access their personal information and, in some cases, have it deleted. The law also gives California consumers the right to opt-out of the sale of their personal information.
Anticipating the rapidly-approaching January effective date, businesses have been working on processes needed to operationalize CCPA requirements without AG guidance. The final CCPA regulations are not required until July 1, 2020—six months after the law’s effective date.
The extensive draft regulations address:
- What constitutes “affirmative authorization” necessary to demonstrate a consumer’s intent to opt-into the sale of personal information
- Compliant privacy notices, including content, timing, and location of the required notices
- How consumers can opt-out of the sale of their personal information
- Use of financial incentives and how to avoid prohibited discriminatory practices
- Methods for submitting deletion and access requests
- How businesses should respond to deletion and access requests
- Requirements for service providers
- How businesses should handle opt-out requests as well as opt-in consent
- Training requirements
- How businesses should verify consumer requests including for password-protected accounts and non-account holders
- Obtaining consent from minors under the age of 16 as well as specific notice requirements relating to minors
The draft regulations give Becerra plenty of time to meet his deadline to finalize the regulations after soliciting “broad public comment” as required by the CCPA. Four public hearings are scheduled to take place at different locations in California from December 2 through 5, 2019. In addition, interested parties may submit public comments before December 6, 2019, either by regular mail or by email to privacyregulations@doj.ca.gov.
The AG is permitted to bring CCPA enforcement actions six months after the CCPA regulations are finalized or July 1, whichever occurs first. If the regulations are finalized before the end of the year, the AG may move up the enforcement date by at least a couple of weeks.
You can find a copy of Becerra’s proposed regulations, details on hearings and public comment and how to RSVP on the State of California’s Department of Justice website.