Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Terms / Notices

Cookies

Privacy Policy

Attorney Advertising

Secure Login

Alumni

  Facebook

MoFo Facebook

  Linkedin

MoFo LinkedIN

Twitter

MoFo Twitter

YouTube

MoFo Youtube

Morrison Foerster - Footer

You have not solved the recaptcha challenge yet or session expired, try again.

Disclaimer

<p>Unsolicited e-mails and information sent to Morrison Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html"><u><em>Privacy Policy</em></u></a>, may not receive a response, and do not create an attorney-client relationship with Morrison Foerster. If you are not already a client of Morrison Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.</p>

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

This week, the California initiative designed to amend and expand the California Consumer Privacy Act of 2018 (CCPA) has reached a notable milestone.

CCPA Ballot Initiative Submits Signatures to Appear on November 2020 Ballot

About Morrison Forester

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

<p>This week, the California initiative designed to amend and expand the California Consumer Privacy Act of 2018 (CCPA) has reached a notable milestone. On May 4, 2020, Californians for Consumer Privacy (the nonprofit group behind the original CCPA initiative in 2018) began submitting the required signatures to state election officials in support of Initiative 19-0021A1. This means the California Privacy Rights Act of 2020<strong> </strong>(CPRA) is one step closer to appearing on the November 3, 2020 ballot.</p><p>If voters approve the CPRA in November 2020, it would significantly expand the scope of the CCPA as summarized below. The regulations under the CPRA would then be required to be finalized by July 1, 2022. With some exceptions, the CPRA would become operative on January 1, 2023, and enforcement powers would begin on July 1, 2023. Generally, the CPRA would only apply to personal information (PI) that is collected after January 1, 2022 (except with respect to consumer requests for access to their PI, which would apply regardless of when the PI was collected).</p><p>The CPRA would introduce new requirements that extend above and beyond those included in the CCPA and the California Attorney General’s (AG) draft regulations under the CCPA, including:</p><h4>1. Scope and Applicability</h4><ul><li>Adding a new category of PI that includes “sensitive information,” and giving consumers rights to opt out of a business’s use and disclosure of their sensitive information</li><li>Altering the scope of the CCPA’s small business exception</li><li>Altering the CCPA’s definition of “business purpose,” including with respect to its applicability to online advertising</li><li>Bolstering the CCPA’s definition of “deidentified” PI</li><li>Broadening the CCPA’s definition of “publicly available” PI, which is excluded from the definition of PI</li><li>Extending the CCPA’s partial exception for employees, independent contractors, business representatives, etc., through January 1, 2023</li><li>Adding account credentials to the list of data to which the CCPA’s private right of action applies following a data breach</li></ul><h4>2. Organizational Requirements </h4><ul><li>Requiring that the collection, use, retention, and sharing of PI be proportionate to its purpose</li><li>Adding provisions that must be included in contracts with third parties with whom PI is shared</li><li>Requiring reasonable security procedures and practices</li><li>Adding a process for law enforcement to require that businesses not delete PI</li><li>Requiring the AG to promulgate a cybersecurity regulation, a regulation regarding automated decision-making, and other regulations related to the CCPA</li></ul><h4>3. Individual Rights</h4><ul><li>Expanding the scope of consumers’ deletion rights</li><li>Adding a consumer right to have inaccurate PI about them corrected</li><li>Imposing direct obligations on service providers regarding responses to consumers’ access, correction, and deletion requests</li><li>Changing some of the exceptions to the CCPA’s deletion right</li><li>Adding a consumer right to opt out of a business’s sharing of his or her PI for cross-site behavioral advertising purposes</li><li>Prohibiting a business from sharing the PI of a child under 16 for cross-site behavioral advertising purposes without consent</li><li>Adding a right for consumers to make “requests to know” that extend earlier than the 12 months preceding the request</li><li>Specifying additional format and portability requirements to which a business must adhere when satisfying a consumer’s right to access “specific pieces” of his or her PI</li></ul><h4>4. Notices and Disclosures</h4><ul><li>Requiring additional disclosures to consumers regarding a business’s disclosure and sharing of their PI</li><li>Requiring that the CCPA privacy notice include retention periods for each category of PI</li></ul><h4>5. Enforcement</h4><ul><li>Creating a California Privacy Protection Agency to implement and enforce the law, in addition to the AG’s enforcement powers</li><li>Removing the 30-day cure period from the enforcement process, and broadening the circumstances in which the higher fine—$7,500 per violation—is applicable</li><li>Adding provisions regarding the purposes for which revenues from fines under the CCPA may be used </li><li>Specifying that implementing and maintaining reasonable security procedures and practices pursuant to California Civil Code Section 1798.81.5 following a data breach does <em>not </em>constitute a cure with respect to that data breach</li></ul><h5><strong>Next Steps</strong></h5><p>At this time, it appears likely that the CPRA will become eligible for the ballot. Californians for Consumer Privacy needed to obtain 623,212 signatures, but the group announced that it is submitting over 900,000. The group is also familiar with gathering verifiable signatures, as it previously achieved ballot eligibility in 2018, with the initiative that paved the way for the CCPA. If the signature verification process is successfully completed, the California Secretary of State will announce that the CPRA is eligible for the November ballot, at which point it will automatically appear on the ballot unless it is withdrawn by its proponents prior to June 25, 2020. </p><p>While Californians for Consumer Privacy withdrew its 2018 CCPA ballot initiative following an eleventh-hour legislative compromise that resulted in the CCPA’s passage, the group has made it clear that it believes the CCPA was “weakened” through legislative amendments thereafter—a belief that contributed to its introduction of this second ballot initiative. This may make it less likely that Californians for Consumer Privacy will accept a legislative compromise in 2020.</p><p>Further details on the CPRA initiative can be found in our previous client alerts dated <a href="/resources/insights/191008-new-ccpa-ballot-initiative.html">October 8,<sup> </sup>2019</a> and <a href="/resources/insights/191212-ccpa-ballot-initiative.html">December 12, 2019</a>.</p><p>The full text of the latest version of the CPRA can be found online <a href="https://www.oag.ca.gov/system/files/initiatives/pdfs/19-0021A1%20%28Consumer%20Privacy%20-%20Version%203%29_1.pdf" target="_blank">here</a>. </p>

<p>CCPA Ballot Initiative Submits Signatures to Appear on November 2020 Ballot</p>

Sign Up

Kristen J. Mathews

Partner

Privacy + Data Security