After having to suspend their final legislative session day on Friday, September 13, 2019, on Saturday, September 14, the California Legislature concluded its business for the year. And with that, agreed on five – or six depending on how one counts the new data broker law in California – amendments to the California Consumer Privacy Act of 2018 (CCPA). Assuming that Governor Newsom signs the amendments, as he is expected to do, we now know what the CCPA is going to look like when it comes into effect on January 1, 2020.
A redline of the CCPA reflecting the amendments expected to be adopted is available here. While many of the amendments included technical updates – fixing typos and updating internal cross references – what follows is an overview of the most significant changes to the CCPA.
- An additional carve out was added to the requirement that information be deleted upon request of the consumer. Specifically, companies may now retain information necessary to fulfill the terms of a written warranty or product recall
- For companies that “operate exclusively online and ha[ve] a direct relationship with a consumer,” the amendments remove the requirement that these companies maintain a toll-free phone number for consumers to exercise their CCPA rights. In place of a phone number, these companies must provide an e-mail address. Any businesses that maintain a website must, in addition to the phone number or e-mail address, also provide a website to consumers through which they can exercise their CCPA rights.
- The definition of “Personal Information” was narrowed and the exclusions to the term were clarified. First, the term was narrowed to only cover information that “is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly with a particular consumer or household.” The addition of the term “reasonably” is an important limiter to the definition. Second, the definition was amended to make clear that any information lawfully made available from a federal, state or local government is not “Personal Information.” Third, the definition was amended to make clear that information which is either deidentified or aggregated will not meet the definition of “Personal Information.”
- The Fair Credit Reporting Act (FCRA) exclusion from CCPA was broadened to make clear that nothing in the CCPA limits the use of personal information in connection with any lawful purpose under FCRA.
- A new exclusion to CCPA was introduced, which permits motor vehicle dealers to share certain vehicle ownership information with vehicle manufacturers for the purpose of accomplishing a repair required under a warranty or recall.
- Employee or prospective employee information, including emergency contact and employee benefits information, will be mostly excluded from the CCPA until January 2021. Businesses must still disclose to employees and prospective employees that they are collecting personal information in compliance with CCPA, and businesses still face liability if that information is exposed in a data breach. However, at least until January 2021, employees and prospective employees do not have the right to exercise consumer rights under the CCPA.
- Similarly, information related to natural persons who are serving as an agent of another business in the context of a commercial transaction are largely excluded from the CCPA until January 2021. That is, these agents do not have the ability to exercise any consumer rights under CCPA. However, like employee data, in the event of a data breach, these company agents can avail themselves of the remedial provisions of the CCPA to the extent that their personal information was collected and retained by a company.
All-in-all, these amendments move the needle a moderate amount in an effort to address industry concerns regarding the breadth of CCPA. The most significant changes – related to employee and B2B (business-to-business) contact data – effectively punt the fight to California’s next legislative session by making those carve outs effective for only one year. These recent amendments also did not address one of the primary concerns of industry participants: what the boundaries of the defined term, “sale” entail. That is where industry participants are hopeful that the Attorney General will come in.
While we have focused on the Amendments to the CCPA, clients should not lose sight of the fact that the California Attorney General is currently in the process of drafting guidance and regulations regarding the implementation of the CCPA, which when published could impact how CCPA is implemented before the January 1, 2020 effective date. The Attorney General has not announced when its guidance will be published. We will provide an additional client alert once the Attorney General publishes its guidance