On January 1, 2023, 20, the California Privacy Rights Act (CPRA) will go into effect. Approved by ballot measure as Proposition 24 in November 2020, it created a new consumer data privacy agency and put California another step ahead of other states in terms of privacy productions for consumers—and data security requirements for enterprises. California already had a privacy law in place, the California Consumer Privacy Act (CCPA), adopted in 2018. It went into effect in January 2020, and enforcement officially began in July 2020.
The CCPA was supposed to help keep California from passing a more stringent privacy initiative via ballot. “CCPA is probably one of the leading privacy laws in the US that protects consumers today,” says Christophe Bertrand, analyst at Enterprise Strategy Group, but it was originally supposed to be more restrictive. “It was the product of many political negotiations that weakened the final product.”
That’s not going to happen with the new law. Once passed, it can only be strengthened, not weakened. It did pass. The CPRA was approved by voters 56% to 44%.
Surprisingly, there wasn’t a lot of lobbying against the ballot initiative by the big tech companies. “I think part of it is the dumpster fire of 2020 and the pandemic and the runup to the election,” says Jessica Lee, partner at Loeb & Loeb and co-chair of the firm’s privacy and security practice. “A lot of things were happening at the same time. Also, over the past couple of years we’ve had a backlash against the big tech companies and a lot of privacy scandals. So, for a tech company to come out against a privacy bill, there are probably some PR and brand considerations.”
The largest companies already must comply with Europe’s General Data Protection Regulation (GDPR). “It’s not like it’s a business-crushing proposition for a lot of the big companies,” Lee says.
The CPRA toughens some requirements, brings California more in line with the GDPR, and creates a new state agency—the California Privacy Protection Agency. Previously, the state’s attorney general dealt with consumer privacy issues on top of all their other responsibilities. Data privacy now gets a dedicated agency with a $10 million basic budget, plus it will also get part of the fines and settlements it collects from companies that break the law. Enforcement of the CPRA begins in July 2023.
A couple of aspects of CPRA will reduce companies’ potential risks and liabilities. First, the CCPA applies to companies serving at least 50,000 California residents, households, or devices. The CPRA raises this to 100,000 and removes “devices” from that list, says Catherine Lyle, head of claims at Coalition, a cyber insurance company. Businesses won’t be held responsible for CPRA violations committed by third parties if certain agreements are in place and the business partner themselves is in compliance with CPRA, she says. “It could reduce your potential liability.”
For companies that are already in compliance with 2018’s CCPA—and especially with Europe’s GDPR—the changes will be minor. That’s the case for Branch Metrics a, global online marketing company that counts Airbnb, Target and Yelp among its thousands of business customers. The company processes billions of consumer records, putting in squarely in the law’s crosshairs.
“One thing that is nice about CPRA is that, in some ways, it more closely aligns with GDPR than CCPA does,” says Branch Metrics CEO Alex Austin. “So, it’s less of a heavy lift if your company has prepared for GDPR.” That means that the incremental changes it will have to make to comply with the CPRA will be “relatively minor,” he says. “It also helps that we have a lot of time to make any required changes,” he adds.
In general, Austin says, the more harmonization among the various privacy laws springing up around the world, the better. “For companies operating globally like Branch, any such closer alignment is a good thing.”
Despite the alignment with both GDPR and CCPA requirements, many companies are not prepared to comply with CPRA. The CYTRIO State of CCPA Privacy Rights Compliance Report for Q3, released in December 2022, surveyed nearly 10,000 US companies that would be subject to CPRA requirements. A large number of them, 92%, were not yet CCPA compliant, let alone CPRA compliant.
Furthermore, only 8.2% of companies surveyed reported having a data subject access request (DSAR) automation solution in place. In fact, 91% of companies are using “time-consuming and error-prone” manual processes to comply with GDPR privacy rights. “As CCPA takes on CPRA enforcement role, there will be significant increase in enforcement resources resulting in increased number of enforcement actions. Non-compliant companies should start preparing for this scenario,” wrote the report’s authors.
For some companies, the changes between the CCPA and the CPRA will be significant, says Dan Frank, US privacy and data protection leader at Deloitte. For example, take data minimization. The new rules prohibit businesses from retaining personal information “longer than absolutely necessary,” he says. That’s a problem, since when it comes to deleting data, companies avoid it like the plague, he says. “Some data is good, more data is better, all data is best.” Data can be analyzed by machine learning and AI systems and can help companies develop new products, services, and applications.
Deleting data is a thorny issue. First, there are legal holds and other regulatory and compliance requirements to retain data. Then there’s the technical side. “You’ve got all these interdependencies that exist across systems that make deleting data scary,” he says. “We don’t want to break anything.”
What most organizations plan to do is to anonymize expired data, Frank says. That way, it can still be used to train AI systems and may create fewer dependency issues. “We’ll see how that plays out in the long term,” he says. “If that data can in any way be attributed back to an individual — directly or by inference — then it’s no longer anonymized. It’s challenging.”
The law’s use of the word “reasonable” is also a red flag. Who decides what’s reasonable? A strong data governance system can also help companies address another aspect of the new law — allowing consumers to correct inaccurate data about themselves.
“This is a challenge if a company has not really streamlined its master data management and doesn’t have a gold record of that data,” says Angela Saverice-Rohan, Americas privacy leader at Ernst & Young. “If you change certain data in one system, how will that impact all of your other processes?”
Companies will now also need to ensure that any business partners they share data with also comply with the CPRA. Since part of the law involves having reasonable cybersecurity measures in place, CISOs may need to get involved, says Saverice-Rohan. “This is work that usually happens during security risk assessments,” she says.
Another big change has to do with how consumers allow their information to be shared. Under the earlier CCPA, companies had to offer California customers the opportunity to opt out of having their data sold to third parties. Now, that includes all kinds of sharing, not just sales, says Deloitte’s Frank. “Consumers need to be able to opt out of particular uses of personal information,” he says. “If they do that, you have to be able to stop using it which, if you think about it, is a pretty arduous task. It makes data governance so critical. It’s going to require fine-grained consent management.”
Another difference is that companies will have additional worries about data breaches, says Frank. For example, breach liability now covers email addresses when used in combination with a security question. If a data breach involves information about minors, the fines can be tripled. “You better know what information you have about children and apply enhanced data protections in case of compromise,” he says.
Both the original CCPA law and the new CPRA allow individual consumers to sue companies after a data breach. Now people will have more potential reasons to file these lawsuits, he says. “Maybe you collected more information than I allowed you to,” he says.
The CPRA also expands the potential for breach-related lawsuits in another way, according to Alan Friel, a partner at the BakerHostetler law firm. Under the CCPA, companies had a window of opportunity to fix problems after consumers filed a complaint, he says. The law was a little confusing in exactly what kinds of problems could be “cured” in this way.
Now, the CPRA clarifies that the right to cure does not include the ability to avoid penalties by plugging security holes after a breach has occurred. “If you fail to maintain adequate security, and you have a breach, and then you remediate what caused that breach, you’re still subject to private right of action and statutory damages,” Friel says. “That is definitely going to be something that’s welcomed by the plaintiffs’ bar.”
Another change is that consumers no longer must show that they were harmed by a breach. “You could sue previously, but you had to show harm,” Friel says.
BakerHostetler is currently defending companies against several privacy-related lawsuits in California. “We were much more successful in knocking off the lawsuits where there was a harm standard,” Friel says. “Most consumers can’t show actual monetary harm from a data breach, which is why they get free credit monitoring. It’s the banks and the retailers that end up having the out-of-pocket costs — consumers, generally, not so much. The game changer here is that the mere fact that the breach has occurred is sufficient harm for standing to bring a lawsuit.”
Companies have already started seeing privacy-related lawsuits. In 2020, children’s clothing retailer Hanna Andersson agreed to a $400,000 settlement in response to a class-action lawsuit stemming from a 2019 data breach. Other companies that have already been sued under CCPA include Salesforce, Walmart, online stationery retailer Minted, the Sunshine Behavioral Health Group, TikTok, Zoom, and Houseparty.
It’s not just consumers and their lawyers that companies will have to defend themselves against, says Ernst & Young’s Saverice-Rohan. Even though the CPRA itself won’t be enforced until later in 2023, the new agency is expected to go to work right away, enforcing existing laws. “In January, the new agency will have the ability to enforce the existing CCPA,” she says. “And they’ll be looking for actions.”
