California Attorney General Releases Second Set of Modifications to the Proposed CCPA Regulations
The modifications aim to clarify and conform the proposed regulations to the text of the California Consumer Privacy Act.
On March 11, 2020, the California Attorney General ("AG") released a second set of modifications to the proposed California Consumer Privacy Act ("CCPA") regulations for written comment. These modifications respond to feedback received during the first public comment period to the AG's initial modifications to the CCPA regulations, which were released on February 10, 2020, and aim to clarify and conform the proposed regulations to the text of the CCPA. More information on the initial modifications can be found in our recent Commentary, "California Attorney General Revises California Consumer Privacy Act Proposed Regulations."
The second set of modifications introduce notable changes to the modified proposed regulations, which include:
- Removing Clarification of "Personal Information" Definition. The second set of modifications have now stricken language that was added in the initial proposed modifications, which clarified that information must be reasonably linked to a consumer in order to constitute "personal information." Specifically, the second set of modifications struck an example about internet protocol ("IP") addresses that made it clear that an IP address not reasonably linked with a particular consumer or household would not be "personal information." Therefore, it is now less clear whether certain data elements (such as an IP address), even where businesses do not maintain such data in a manner that would reasonably link the data with a particular consumer or household, may be considered "personal information."
- Expanding Notice Requirement Exemptions for Businesses that Collect Data Indirectly. These modifications now clarify that, in addition to registered data brokers, businesses that collect—but do not sell—data indirectly from consumers are exempted from providing a notice at collection.
- Eliminating Opt-Out Button Logo. The second set of modifications remove the newly designed opt-out button but still do not provide clarification to the broadly defined term, "sale."
- Clarifying Privacy Policy Disclosures. The second modifications attempt to harmonize the proposed regulations and text of the CCPA by clarifying that businesses must also identify in their privacy policies the categories of sources from which they collect personal information and the business or commercial purpose for collecting or selling personal information.
- Adjusting Right to Know Disclosures and Exemptions. Although businesses are still prohibited from disclosing certain types of sensitive data in response to a consumer request (e.g., Social Security number, government-issued identification numbers, biometric data, etc.), the second modifications require businesses to nonetheless inform consumers with "sufficient particularly" that they have collected such sensitive data.
The AG is accepting written comments to this second set of proposed modifications until Friday, March 27, 2020, at 5:00 p.m. (PST). The Department of Justice has provided more information on how to submit comments. The AG cannot bring an enforcement action under the CCPA until July 1, 2020.
