The CCPA May Enforce Latest Regulation

 After 4 years since it's enaction (2020), the California Privacy Rights Act (CPRA), the Third District Court restored the California Privacy Rights Protection Agency's("Agency") ability to enforce the new regulations to the CCPA (California Consumer Privacy Act).

 

The CPRA is a consumer privacy law that protects data privacy rights.  It builds on the previous legislation (CCPA) passed in 2018 and expands employer's obligations when it comes to collecting, storing, using and sharing personal data belonging to their employees. The law should be referred to as “CCPA, as amended”.

 

The CPRA applies to employers with at least 1 employee in California and if the company made over $25mil in the previous calendar year.  If the employer is not in California, but you have one or more employees working remotely in California, the law would only apply to those employees.

 

The CPRA requires employers to inform individuals who reside in California about the employment-related personal information (PI) collected by the employer and how that data is used.  Covered individuals can include applicants, employees, dependents and independent contractors.

 

With regards to the CCPA, as amended, “Business” means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for profit or financial benefit of its shareholders or other owners, that collects consumer's' personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:

 

(A) As of January 1, of the calendar year, had an annual gross revenue in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to paragraph (5) of subdivision (a) of 1798.185.

 

(B) Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.

 

(C) Derives 50 percent or more of it's annual revenues from selling or sharing consumer's personal information.

 

Businesses may want to consider immediate compliance with the final regulations adopted on March 29, 2023.  The court's ruling eliminated any grace period that businesses might have anticipated for adapting their practices to meet the new requirements. 

 

Source: California Labor & Law Blog, received on 02.13.2024; Codes Display Text (ca.gov), accessed on 02.13.2024. California Privacy Protection Agency (CPPA), accessed on 02.13.2024.