Privacy and data protection law in California, U.S.
This article is about a privacy and data protection law in California. For the other California law also abbreviated CPRA, see California Public Records Act.
The California Privacy Rights Act of 2020 (CPRA), also known as Proposition 24, is a California ballot proposition that was approved by a majority of voters after appearing on the ballot for the general election on November 3, 2020.[1][2][3] This proposition expands California's consumer privacy law and builds upon the California Consumer Privacy Act (CCPA) of 2018, which established a foundation for consumer privacy regulations.[4]
The CPRA enshrines more provisions in California state law, allowing consumers to prevent businesses from sharing their personal data, correct inaccurate personal data, and limit businesses' usage of "sensitive personal information," which includes precise geolocation, race, ethnicity, religion, genetic data, private communications, sexual orientation, and specified health information. The California Privacy Protection Agency was established to implement and enforce state privacy laws, investigate violations, and assess penalties of violators.[5] The CPRA also removes the set time period in which businesses can correct violations without penalty, prohibits businesses from holding onto personal data for longer than necessary, triples the maximum fines for violations involving children under the age of 16 (up to $7,500), and authorizes civil penalties for the theft of specified login information.[6][7]
The CPRA took effect on January 1, 2023, applying to personal data collected on or after January 1, 2022.[8] The law cannot be repealed by state legislature, and any amendments made must be “consistent with and further the purpose and intent” of the Act.[9]
Background
As technology has become more integrated into daily life, lawmakers around the world have pushed for greater regulation of data privacy.[10] In 1950, the European Convention on Human Rights asserted that data privacy should be subject to legal protections.[10][11] Several episodes of unknown use and sale of consumer data, such as the Cambridge Analytica scandal, led to US lawmakers pursuing better data privacy protections particularly at the state-level.[10][12] Additionally, the passing of the European Union's (EU) General Data Protection Regulation (GDPR) in 2018 spurred greater interest in adopting a similar measure in the United States.[11] The GDPR is the strictest data privacy law in the world, with few exceptions and hefty fines. In California, these concerns manifested as the California Consumer Protection Act somewhat modeled on the EU’s GDPR.[11]
The CCPA’s initial drafting and placement on the 2018 ballot was led by Alastair Mactaggart.[12] He later came to an agreement with Californian lawmakers to pass a scaled back version of the CCPA which was ultimately signed into law by Governor Brown. Although passed in 2018, the CCPA would not come into effect until January 1, 2020.[11] In 2020, Proposition 24, or the CPRA, appeared on the California ballot. The Act was designed to amend the CCPA to expand consumer data privacy.[13] Most notably, the CPRA altered the criteria that subjects a business to its' rules and established the California Privacy Protection Agency to take the lead on enforcement of the CCPA.[11] The CPRA was passed with 56.2% of California voters in favor of the proposition and went into effect on January 1, 2023.[14]
The initiative represents an expansion of provisions first laid out by the CCPA. Key changes include requiring businesses to obtain permission from consumers younger than 16 before collecting their data and a parent or guardian before collecting data from consumers younger than 13.[15] The CPRA also altered the CCPA to apply to businesses buying, selling, or sharing personal information of 100,000 or more consumers compared to the previous 50,000 or more.[15] The California Privacy Protection Agency was developed to protect and enforce these provisions, taking over prior responsibilities from the California Department of Justice.[4]
Purpose and intentions
The overall intention of the act is to resolve information asymmetry between consumers and businesses concerning the use of personal information. To that end the key rights of the Act include:
Control the use of personal information and limiting the use of sensitive personal information through the right to opt out of sale.
The ability to correct, delete, and transfer personal information.
The right to easily accessible self-serve tools to opt-out of sale or limit use of personal data
Exercise privacy rights without being penalized or discriminated against.
Hold businesses accountable for failing to take reasonable information security precautions.
Know who is collecting a child's personal information, how it is being used, and to whom it is disclosed.[16]
The primary purpose of the CPRA is to further protect personal consumer information.[10] The act defines consumer information as any information that could reasonably identify or be related to a specific person or household.[10][16] This includes names, addresses, email address, social security number, and characteristics defined as being protected under California and federal law such as race, gender, or religion.[16] The CPRA also alters the criteria for businesses to be subject to the act. The act applies to businesses meeting any of the three following criteria: (1) have $25 million in annual gross revenue in the preceding year (2) buys, sells, or shares the personal information of 100,000 or more consumers or households (3) businesses whose majority of revenue (50% or more) is earned from selling or sharing personal consumer information.[11][16]
The ability to revoke consent for a business to sell or share a consumer's information through easily accessible tools is an integral part of the CPRA's modification of the CCPA. The CPRA mandates that a business' homepage must clearly display a link titled "Do Not Sell My Personal Information."[16] A business may not require a consumer to make an account or go through multiple steps to opt out.[16] This right essentially permits Californian consumers to require businesses to stop selling their information, thereby preventing the kinds of misuse and unknown sales of personal data that spurred the creation of the CCPA.[10]
Results
The proposition passed with roughly 55% of California voters voting in favor of the measure.[17]
1 2 3 4 5 6 Saquella, Alexandria J (January 2020). "Personal Data Vulnerability: Constitutional Issues with the California Consumer Privacy Act". Jurimetrics. 60 (2): 215–45 – via EBSCOhost.
1 2 3 4 5 6 Lisowski, Jena (March 1, 2024). "California Data Privacy Law and Automated Decision-making". The Journal of Corporation Law. 49 (3): 701–26 – via EBSCOhost.
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
