CPRA Takes Effect January 1
As 2023 quickly approaches, it’s a good time to take stock of new privacy regimes taking effect January 1. We outline the Virginia Privacy Law, here, and this article will examine the California Privacy Rights Act (the “CPRA”). The CPRA takes effect on January 1, 2023, although enforcement will not begin until July 1, 2023. The CPRA makes a number of updates to its predecessor law, the California Consumer Privacy Act (the “CCPA”). One of the major changes the CPRA makes to the CCPA is the expansion of individual rights consumers gain under the law. The CPRA provides California consumers with additional privacy rights, including:
- The right to correct inaccurate personal information that a business has about them,
- The right to limit the use and disclosure of sensitive personal information collected about them, and
- In addition to the right to opt-out of the sale of information, the right to opt-out of the sharing of information about them, when the sharing of information is for cross-contextual behavioral advertising.
As companies roll out compliance with the CPRA, providing notice of and fulfilling these individual rights should remain a focus. In particular, because enforcement actions under the CCPA have focused on these individual rights. To date, a number of enforcement actions have centered on individual privacy rights, including their proper disclosure in privacy notices, as well as the fulfillment of such invoked rights.
Another major aspect of the CPRA is the relationship between a business and its third party vendors that provide services to businesses. The CPRA and its currently proposed regulations include prescriptive requirements for contracts between businesses and their service providers. Businesses should assess their third party vendor relationships, including analysis of the contract between them, to ensure it complies with the CPRA’s new requirements.