The California Privacy Rights Act of 2020: A broad and complex data processing regulation that applies to businesses worldwide

Lothar Determann and Jonathan Tam
Additional contact information
Lothar Determann: Partner, Baker McKenzie, USA
Jonathan Tam: Senior Associate, Baker McKenzie, USA

Journal of Data Protection & Privacy, 2020, vol. 4, issue 1, 7-21

Abstract: The California Privacy Rights Act of 2020 (CPRA) introduces sweeping changes to the California Consumer Privacy Act of 2018 (CCPA), most of which will become operative as of 1st January, 2023, with a ‘look back’ to 1st January, 2022. Key revisions include a new definition of ‘sensitive personal information’ and detailed obligations regarding the processing of sensitive personal information for non-essential purposes; a new and counterintuitive definition of ‘sharing’ personal information and related restrictions aimed at the digital advertising industry; new data subject rights to correct inaccurate information and opt out of the use of automated decision-making technology; new requirements to include data protection and processing terms in contracts with data recipients and vendors; new requirements regarding what privacy notices must include and how they must be furnished to data subjects; and the establishment of a new privacy authority, the California Privacy Protection Agency. Although some requirements are similar to those in other jurisdictions, some are unique in their scope and even more onerous and detailed than those of the European Union General Data Protection Regulation. For example, CCPA also applies to ‘household data’ and will require companies to include California-specific language in their vendor contracts and privacy notices. This paper summarises some of the key revisions that CPRA makes to CCPA and offers practical recommendations on how companies subject to the law must comply. Companies that do business in California must comply not only with the revised CCPA but also detailed laws specific to particular sectors, industries, harms and activities.

Keywords: California Consumer Privacy Act (CCPA); California Privacy Rights Act (CPRA); California Privacy Protection Agency (CPPA); cross-context behavioural advertising; right to know; right to access; right to deletion; right to correct inaccurate personal information; right to opt out of selling; right to opt out of sharing; right to restrict use and disclosure of sensitive personal information; right to opt out of automated decision-making technology; right to no retaliation (search for similar items in EconPapers)
JEL-codes: K2 (search for similar items in EconPapers)
Date: 2020
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/6067/download/ (application/pdf)
https://hstalks.com/article/6067/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:jdpp00:y:2020:v:4:i:1:p:7-21

Access Statistics for this article

More articles in Journal of Data Protection & Privacy from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().