Alert

March 12, 2020

California Attorney General Releases Second Set of Revisions to Proposed CCPA Regulations

On Wednesday, March 11, 2020, the Office of the Attorney General of California released a second set of revisions to the proposed regulations implementing the California Consumer Privacy Act.

The modifications include a number of substantive changes to the proposals. Below are some of the most notable changes. This list is not exhaustive, and regulated businesses should consult the full text of the proposed rules with qualified counsel.

  • Guidance on term "personal information." The first set of revisions to the proposed regulations added a section that provided guidance on the term "personal information," reminding businesses that the law only applies to information retained in identified or reasonably identifiable form. This second set of revisions removes that proposed section without explaining the reason for the change.
  • Online privacy policy content. These new revisions provide that a business's online privacy policy must include the categories of sources from which the business collected consumers' personal information and the business or commercial purposes for collecting or selling personal information.
  • Notice at Collection scope. The new set of revisions adds a section that provides that a business that does not collect personal information directly from consumers is not required to provide a Notice at Collection "if it does not sell the consumer's personal information." The proposed regulations do not offer any information about the intent behind this section.
  • Notice at Collection for employees. This second set of revisions provides that employment-related Notices at Collection would not need to include a link to the business's privacy policy.

The Attorney General's Office is receiving comments on these changes until 5:00 p.m. California time on Friday, March 27, 2020, by email to PrivacyRegulations@doj.ca.gov, or by mail to:

Lisa B. Kim, Privacy Regulations Coordinator
California Office of the Attorney General
300 South Spring Street, First Floor
Los Angeles, CA 90013

It is not clear when the regulations will be finalized, and it is not clear whether the final regulations will provide for a delayed effective or enforcement date.

The CCPA became effective January 1, 2020. The Attorney General may not bring an enforcement action until July 1, 2020.

The CCPA provides California residents with certain rights with regard to their personal information and imposes related requirements on certain businesses in California. Regulated businesses should consult the current and complete text of the law and regulations alongside knowledgeable counsel. Significant exemptions may apply to financial services businesses.

Businesses can view these second revised proposed regulations here, with a redline of changes from the October 2019 proposal here. Businesses can also obtain more information about the CCPA and the proposed regulations on the Attorney General's website, available here.

Webb McArthur of Hudson Cook, LLP, provided this alert.