Share these talks and lectures with your colleagues
Invite colleaguesPractice paper
The California Privacy Rights Act of 2020: A broad and complex data processing regulation that applies to businesses worldwide
Journal of Data Protection & Privacy,
4
(1),
7-21
(2020)
Abstract
The California Privacy Rights Act of 2020 (CPRA) introduces sweeping changes to the California Consumer Privacy Act of 2018 (CCPA), most of which will become operative as of 1st January, 2023, with a ‘look back’ to 1st January, 2022. Key revisions include a new definition of ‘sensitive personal information’ and detailed obligations regarding the processing of sensitive personal information for non-essential purposes; a new and counterintuitive definition of ‘sharing’ personal information and related restrictions aimed at the digital advertising industry; new data subject rights to correct inaccurate information and opt out of the use of automated decision-making technology; new requirements to include data protection and processing terms in contracts with data recipients and vendors; new requirements regarding what privacy notices must include and how they must be furnished to data subjects; and the establishment of a new privacy authority, the California Privacy Protection Agency. Although some requirements are similar to those in other jurisdictions, some are unique in their scope and even more onerous and detailed than those of the European Union General Data Protection Regulation. For example, CCPA also applies to ‘household data’ and will require companies to include California-specific language in their vendor contracts and privacy notices. This paper summarises some of the key revisions that CPRA makes to CCPA and offers practical recommendations on how companies subject to the law must comply. Companies that do business in California must comply not only with the revised CCPA but also detailed laws specific to particular sectors, industries, harms and activities.
Keywords: California Consumer Privacy Act (CCPA); California Privacy Rights Act (CPRA); California Privacy Protection Agency (CPPA); cross-context behavioural advertising; right to know; right to access; right to deletion; right to correct inaccurate personal information; right to opt out of selling; right to opt out of sharing; right to restrict use and disclosure of sensitive personal information; right to opt out of automated decision-making technology; right to no retaliation
The full article is available to subscribers to the journal.
Author's Biography
Lothar Determann teaches computer, internet, data privacy and commercial law at Freie Universität Berlin, the University of California, Berkeley, School of Law, and Hastings College of the Law, and he practices law as a partner at Baker McKenzie, where he has been counselling companies since 1998 on privacy law compliance and taking products and business models international. He has authored numerous articles, treatise contributions and books, including Determann’s Field Guide to Data Privacy Law and California Privacy Law: Practical Guide and Commentary.
Jonathan Tam is a senior associate at Baker McKenzie focusing on global privacy, technology transactions and cybersecurity. He started in Baker McKenzie’s Toronto office in 2012 and transferred to the firm’s San Francisco office in 2018. He is a co-chair of the IAPP’s Silicon Valley KnowledgeNet chapter and a member of the Executive Committee of the San Francisco Bar Association’s Privacy and Cybersecurity Section.
