Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Terms / Notices

Cookies

Privacy Policy

Attorney Advertising

Secure Login

Alumni

  Facebook

MoFo Facebook

  Linkedin

MoFo LinkedIN

Twitter

MoFo Twitter

YouTube

MoFo Youtube

Morrison Foerster - Footer

You have not solved the recaptcha challenge yet or session expired, try again.

Disclaimer

Unsolicited e-mails and information sent to Morrison Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a>, may not receive a response, and do not create an attorney-client relationship with Morrison Foerster. If you are not already a client of Morrison Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

On Wednesday, March 11, 2020, the California Attorney General’s office published a 2nd set of modifications to the draft regulations under the California Consumer Privacy Act (“CCPA”).

California Attorney General Issues 2nd Set of Modified Draft CCPA Regulations

About Morrison Forester

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

On Wednesday, March 11, 2020, the California Attorney General’s office published a 2nd set of modifications to the draft regulations under the California Consumer Privacy Act (“CCPA”), available <a target="_blank" href="https://oag.ca.gov/privacy/ccpa">here</a>. These still are not the Attorney General’s final CCPA regulations but rather further modified draft regulations that are subject to a new public comment period. The deadline to submit written comments on the 2nd set of modified CCPA draft regulations is March 27, 2020, at 5:00 pm (PST).The Attorney General’s office also issued a <a target="_blank" href="https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-text-of-second-set-mod-031120.pdf?">redlined</a> version of the modified regulations showing how this latest version differs from the original and 1st modified set of draft regulations.Many of the revisions were minor edits and corrections. Below, we provide a high-level overview of key revisions in the 2nd set of modified draft regulations.<h4>1. Definitions</h4>The 2nd set of modified draft regulations revises certain key definitions, particularly the definitions of “personal information” and “financial incentives.”<ul><li>Personal Information. The 2nd set of modified draft regulations removes guidance that was added by the 1st set that had stated that whether information is considered “personal information” depends on whether a business maintains the information in a manner that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household. Consequently, the illustrative example allowing that IP addresses may not be considered personal information in certain cases was also removed. </li><li>Financial Incentives. The definition of “financial incentive” has been updated and broadened to mean a program, benefit or other offering, including payments to consumers related to the collection, retention, or sale of personal information. Previously, a financial incentive had been defined as compensation for the disclosure, deletion or sale of personal information. Similar updates are carried throughout the regulations wherever financial incentives are addressed.</li></ul><h4>2. Notices</h4>The modified draft regulations make some discrete changes to requirements for CCPA notices.<ul><li>Do Not Sell Button. The 2nd set of modified draft regulations removes the subsection about the Opt Out Button and Logo, including the design for the “Do Not Sell My Personal Information” button. This section has not been replaced by updated guidance.</li><li>Privacy Policy. If a business has actual knowledge that it sells the personal information of minors under age 16, then, under the 2nd set of modified draft regulations, a business’s privacy policy must include a description of the processes required for minors (or their parent or guardian if under age 13) to opt in to the sale of personal information.</li><li>Notice at Collection. The 2nd set of modified draft regulations also provides that a business that does not collect personal information directly from a consumer does not need to provide notice at collection if it does not sell the consumer’s personal information. </li><li>Employment-Related Notices. The 2nd set of modified draft regulations updates previous guidance regarding employment-related notices, stating that such notices are not required to provide a link to the business’s privacy policy.</li></ul><h4>3. Service Providers</h4>The 2nd set of modified draft regulations modifies the restrictions on a service provider’s internal use of personal information obtained in the course of providing services. Specifically, a service provider may use such personal information to build or improve the quality of its services; however, such use cannot include “building or modifying household or consumer profiles to use in providing services to another business.” This seems to at least partially reinsert the previously removed prohibition on service providers using the personal information collected from one client to provide a service to another client.<h4>4. Requests to Know</h4>The 2nd set of modified draft regulations clarifies that, in response to a request to know specific pieces of personal information collected, although a business must not provide certain types of sensitive personal information such as a consumer’s government-issued identification numbers, financial account, medical or health insurance number, unique biometric data or account passwords, businesses must, in response to such a request, inform the consumer “with sufficient particularity” that it has collected this type of information.The 2nd set of modified CCPA draft regulations reflects the Attorney General’s efforts to respond to public input on the 1st set of modified draft regulations and to consider additional input before finalizing the regulations. As noted above, companies have until March 27, 2020, at 5:00 pm (PST) to submit comments on the 2nd set of modified draft regulations to the <a target="_blank" href="https://oag.ca.gov/privacy/ccpa">Attorney General’s office</a>.For updates and other resources on CCPA, please visit Morrison & Foerster’s <a href="/special-content/california-consumer-privacy-act/">CCPA Resource Center</a>.

California Attorney General Issues 2nd Set of Modified Draft CCPA Regulations