Privacy & Information Security Law Blog

On May 4, 2020, Californians for Consumer Privacy (the group behind the ballot initiative that inspired the California Consumer Privacy Act of 2018 (“CCPA”)) announced that it had collected over 900,000 signatures to qualify the California Privacy Rights Act (“CPRA”) for the November 2020 ballot. The group announced that it was taking steps to submit the CPRA for inclusion on the November ballot in counties across California. The CPRA would amend the CCPA to create new and additional privacy rights and obligations in California, including the following:

• Sensitive Personal Information. The CPRA would establish a new category of “sensitive personal information,” which would be defined to include a Social Security Number, driver’s license number, passport number, financial account information, precise geolocation, race, ethnicity, religion, union membership, personal communications, genetic data, biometric or health information, and information about sex life or sexual orientation. The CPRA would also give consumers certain new rights around the use of “sensitive personal information.”
• Right of Correction. The CPRA would grant California consumers the right to request the correction of their personal information held by a business if that information is inaccurate.
• Children’s Data. The CPRA purports to enhance children’s privacy by tripling fines for violations of the CCPA’s opt-in to sale right and creating a new requirement to obtain opt-in consent to sell or share data from consumers under the age of 16.
• Data Breach Liability Provision. The CPRA would amend the data breach liability provision of the CCPA to clarify that breaches resulting in the compromise of a consumer’s email address in combination with a password or security question and answer that would permit access to the consumer’s account are subject to the relevant provision.
• Enforcement. The CPRA would establish the California Privacy Protection Agency to enforce the law. The CCPA, by contrast, is enforceable by the California Attorney General’s Office.

We previously reported on a version of the CPRA when it was introduced by Alastair Mactaggart, the drafter of the 2018 ballot initiative that formed the basis of the CCPA, in September 2019.