On October 10, 2019, California Attorney General Xavier Becerra announced the publication of proposed regulations to implement the California Consumer Privacy Act (“CCPA”). The CCPA, which was enacted in 2018, creates new rights by giving consumers: (1) the right to know what personal information is being collected about them and how it is being used and shared; (2) the right to delete personal information collected from them; (3) the right to opt-out of the sale of their personal information; and (4) the right to equal service and price, even if they exercise their privacy rights (CA Civ. Code, §§ 1798.100-1798.199.) As the principal enforcer of the CCPA, the Attorney General is required to adopt regulations that provide guidance to businesses regarding procedures and how to comply.
The announcement included a Notice of Proposed Rulemaking Action and Text of Proposed Regulations. Additionally, an Initial Statement of Reasons was released which expands on the purpose of the proposed regulations.
The proposed regulations contain five main components and create additional requirements that are not found in the text of the statute.
Notice to Consumers: Regulations that establish the rules regarding how businesses must notify consumers about their rights under the CCPA. There are four notices required under the CCPA: Notice at Collection of Personal Information, Notice of Right to Opt-Out of Sale of Personal Information, Notice of Financial Incentive, and Privacy Policy. The notices must be designed as easy to read and understandable to an average consumer, along with being accessible to consumers with disabilities.
Business Practices for Handling Consumer Requests: The rules and procedures for how businesses must handle consumer requests pursuant to CCPA. It provides the methods businesses must provide to consumers to submit requests, the requirement for providing confirmation of receipt and time limits to respond.
Verification of Requests: Regulations that establish rules and procedures for how businesses can verify the identity of the consumers making requests. Businesses must document and comply with a reasonable method of verification that takes into consideration the sensitivity of the personal information and risk of harm to the consumer caused by unauthorized access or deletion.
Special Rules Regarding Minors: The regulations establish the rules and procedures for businesses to obtain affirmative authorization for the sale of the personal information of minors.
Non-Discrimination: Regulations that establish the rules and guidelines regarding discriminatory practices and financial incentive offerings. It provides description of the kinds of business practices that constitute discrimination as set forth in the CCPA.
The proposed regulations will not be finalized until the Attorney General hosts a series of public hearings and considers public comments submitted prior to the deadline of December 6, 2019. The final regulations are expected to be released in early 2020, with enforcement to follow beginning in July 2020.
