The California legislature passed, and the Governor signed, the California Consumer Privacy Act (the “CCPA”) earlier this year to be effective January 1, 2020. The California Consumer Privacy Act imposes significant new duties on businesses who collect the personal information of California consumers, including mortgage lenders and brokers, as well as their service providers such as DocMagic.
While the CCPA is effective January 1, 2020, there is an included provision which prohibits the California Attorney General from bringing any enforcement action until at least July 1, 2020, or 6 months after final regulations are published, whichever is sooner. As of December 31, the California Attorney General has not published final regulations for the CCPA, so enforcement may not occur until July 1, 2020. The comment period on proposed CCPA regulations ended December 6, 2019.
The CCPA requires that businesses who collect personal information of California consumers provide a Notice of Collection at or before the collection occurs. The Notice of Collection must include the categories of information that are to be collected and the purposes for which the categories will be used. Businesses must also disclose to California consumers that they have a right to request to know what personal information has been collected about them by a business and that they have a right to request to delete such information. Businesses who sell the personal information of California consumers must also include a description of the consumer’s right to opt out of the sale of their information.
While not finalized, the Attorney General’s proposed regulations included requirements for businesses to provide certain notices to consumers, procedures for handling consumer requests, as well as rules regarding personal information of minors and rules regarding non-discrimination practices. The AG’s office proposed regulations in October and then held a series of meetings and hearings to solicit public feedback. Comments on the proposed regulations were accepted until December 6, 2019. See our prior article discussing the proposed CCPA regulations here. As of December 30, 2019, the Attorney General has not yet posted final regulations for enforcing the CCPA. As a result, no enforcement by the Attorney General may occur until after July 1, 2020, according to the terms of the CCPA statutory text.
DocMagic has updated our privacy policies on consumer-facing applications and our website, to reflect the necessary disclosures applicable to our business for California consumers, specifically as a service provider processing the information of California consumers only in the service provider capacity. DocMagic clients who do business with California consumers should also review their own privacy policies and ensure compliance with the provisions of the CCPA. This may include an additional California Privacy Policy with your initial disclosures, although in most cases, this notice would be after disclosure is required under the “at or before collection” requirement under the CCPA proposed regulations. Lenders will likely find it necessary to amend their public-facing privacy policies, such as on their websites or on any online application or prequalification request portal, to include consumer notices of their rights under the CCPA.
