CCPA vs. CPRA: Key Components Explained
The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) have many provisions that affect businesses operating in the state. The CPRA is an amendment to the CCPA, which was approved in November 2020. The CPRA has technically been in effect since December 16, 2020. However, most of the revisions to the CCPA won’t come into force until January 1, 2023. Learn how the CCPA compares to the CPRA and how it could affect your business.
Expanded consumer privacy rights under the CPRA
The following are the five consumer privacy rights that have been modified under the CPRA:
Right to access
Businesses must provide consumers with their personal and sensitive information collected, shared, or sold to third parties, the categories of PII, and the third parties involved when requested.
There are no legal obligations for companies to save data for a particular amount of time, so it's hard to say how long the company will retain PII.
Right to delete
The CPRA gives consumers new rights that allow them to more easily get rid of the collected data that companies have on them.
Right to data portability
The CCPA gives users the right to access their data. However, users can now transfer their personal information to different companies under the CPRA.
Right to opt-out
While the CCPA only allows for data subjects to opt-out of data sales, the CPRA gives users the right to opt-out of the sale and also out of sharing of their personal information with third parties.
Right to opt-in for minors
CCPA prohibits the sale of personal information of California consumers under 16 years without their opt-in consent. The CPRA states that you have to wait for 12 months before requesting consent from a minor who has refused the initial request.
New consumer rights
The CPRA sets four new user privacy rights.
Right to correct data
This right applies when a consumer’s data is inaccurate. It allows them to ask for this information to be corrected.
Right to access information about automated decision making
Data subjects are entitled to request information about automated decision-making processes concerning their data, as well as the likely results of those processes.
Right to limit use & disclosure of sensitive personal information
A company must, by law, respond to a consumer’s requests to limit the use and disclosure of their data.
Right to opt-out of automated decision making
California residents can also choose to opt-out of automated decision-making technology, such as individual profiling.
Who must comply
The CPRA exempts some small businesses from the CCPA. Previously, under the CCPA, a business that collected data from over 50,000 data users would be subject to the act. Under the CPRA, that number has increased to 100,000.
CPRA also applies to any company with at least half of its revenue involving transactions coming from the sales or sharing of consumers’ data or with a gross annual revenue of over $25 million.
GDPR principles incorporated in CPRA
The CPRA specifically mentions that companies may not retain PII for longer than necessary. When collecting data, companies also have to inform customers of the length of time each type of data is stored.
Companies should only collect, use, and store users’ personally identifiable information that is reasonably necessary.
If a company chooses to use customers’ personal information in a way that differs from how it initially disclosed it, the company needs to first inform all customers.
30-day cure period abolished
In the new context of things, organizations won’t automatically get a 30-day cure period which used to allow the possibility for violations to be addressed. However, at the discretion of the CPPA, cure periods can still be given to violators.
CPRA expanded private right of action
The California Consumer Privacy Act gave consumers who have had their unredacted, or unencrypted data compromised the right to take legal action against companies. The CPRA amended this term to cover some personal data like consumers’ passwords, email addresses, and security questions.
Contractual provisions for data shared with third parties
The CPRA obligates businesses to have a contract in place with any third party that is receiving or sharing their customer data. This enhances customer data security to reduce the number of third-party risks.
Addition of the SPI category
The CPRA adds a group of highly sensitive personal information that is subject to more strict purpose limitations and disclosure requirements. This includes:
- Biometric information for identification
- Contents of communication
- Credit or debit card number with access codes
- Driver’s license
- Ethnic origin
- Financial account information and log-in credentials
- Genetic data
- Health information
- Information about sex or sexual orientation
- Passport number
- Precise geolocation data
- Religious or philosophical beliefs
- Social Security Number
- State identification card
Mandatory audit and security risk assessment
The CPRA mandates that businesses comply with annual cybersecurity audits and periodic risk assessments to protect the data of consumers. Businesses must start assessing risks related to data security and information confidentiality to prioritize the risks they face and implement a risk assessment framework. It is an important step in developing a cybersecurity strategy, which helps organizations take the appropriate steps to mitigate risks.
Creation of a new privacy enforcement authority
The CCPA was first enforced by the office of the Attorney General. The CPRA established a new privacy enforcement authority, the California Privacy Protection Agency (CPPA), and grants it powers to investigate and enforce the act.
Extra data protection for children’s PII
The CPRA is similar to the CCPA because it also prohibits the sale of personal information of those under 16. Nonetheless, violations involving children’s data are liable as intentional violations, meaning they are more severe. Violating CPRA often comes with a penalty of up to $7,500 for intentional violations and a penalty of up to $2,500 for unintentional violations.
Why businesses must pay attention to these laws
CPRA will not go fully into effect until January 1, 2023. However, businesses that operate in California should start now to prepare for it.
With the 30-day cure period being abolished, the penalty for underage violations increased to $7,500, as well as the established body for enforcement (the CPPA), businesses have to be careful not to violate these new privacy regulations.
Businesses should go through the information related to CPRA, conduct an assessment of the measures they currently have for CPRA compliance and check whether there are any gaps in their current policy
Keeping up with a privacy management
Complying with ever-evolving privacy regulations can be a daunting task in today’s landscape. With a full privacy management suite like Mine PrivacyOps, businesses can ensure that their data privacy operations are appropriately managed and compliant with privacy laws, protecting their organization from possible fines, limiting risks, and maintaining users’ trust.