In July, we reported on the California Consumer Privacy Act (CCPA), a sweeping privacy law signed by California Governor Jerry Brown. On August 31st, the California legislature passed SB1121, a bill to amend the CCPA. The amendments, currently awaiting Governor Brown’s signature, make the following changes:
- Earlier effectiveness and delayed enforcement. The amendments change the effective date of the CCPA from January 1, 2020 to immediate effectiveness. This cuts off any conflicting local laws that may have passed in the next year. At the same time, the amendments delay the Act’s enforcement by pushing back the California Attorney General’s deadline to draft and adopt the CCPA’s implementing regulations from January 1, 2020 to July 1, 2020. The Attorney General’s ability to bring enforcement actions is also effectively delayed by six months to July 1, 2020.
- Revisions to the private right of action. The CCPA gives consumers a private right of action against businesses that violate the CCPA. Under the original version of the CCPA, consumers were required to notify the California Attorney General within 30 days of initiating any civil litigation against a company alleged to have failed to implement and maintain reasonable security procedures and practices resulting in a data breach. The Attorney General had the ability to inform the consumer plaintiff(s) of the its intent to pursue a civil action against the company or instruct a consumer not to proceed with civil litigation. Under the amendments, consumers no longer have to notify the Attorney General when they have filed suit and the Attorney General can no longer instruct a consumer to not proceed with an action.
- Clear exemptions for other laws. The CCPA contains exemptions relating to other statutes that subject companies to separate data privacy requirements. These statutes include the federal Gramm-Leach-Bliley Act (GLBA) and the California Financial Information Privacy Act (Cal-FIPA). According to the original version of the CCPA, information collected in accordance with these statutes would be exempt from the reach of the CCPA, only to the extent the CCPA was “in conflict” with these other statutes. The amendments to the CCPA remove the “in conflict” language; thus, information collected pursuant to these statutes are not subject to the CCPA. The amendments also add an exemption for information collected pursuant to the federal Health Insurance Portability and Accountability Act (HIPAA).
If Governor Brown fails to act on the amended bill by September 30, the measure will automatically become law.
Lawmakers, businesses, and consumer advocacy groups expect that these will be the first in a series of amendments to the CCPA. We will report on additional changes when the California legislature reconvenes in January 2019. In the meantime, and in preparation for 2020 enforcement, businesses located in California or that do business with California consumers should take steps to follow the CCPA in its current form.
For more information about whether your business is subject to the CCPA and what actions you need to take to comply with the law, please contact a member of Sussman Shank’s Privacy and Data Security practice at 503-227-1111.