California’s Secretary of State Alex Padilla announced the California Privacy Rights Act qualified for the state’s November ballot. Californians for Consumer Privacy Founder Alastair Mactaggart filed the required 623,212 signatures with California counties.
The California Privacy Rights Act is a ballot initiative, which, if adopted, would replace the California Consumer Privacy Act (CCPA), which entered into force just months earlier this year.
Top 10 Proposed Provisions / Changes:
- Sensitive data: New definition, limits on use and sharing, mandated link or respect of global opt-out
- New enforcement agency: California Privacy Protection Agency
- Expanded breach liability: Definition now includes email/password combos
- Audits and risk assessments: To be prescribed through regulation for high-risk processing
- Automated decision-making and profiling: Restrictions for certain industries
- Data correction: New consumer rights
- Children’s data: Strengthened opt-in rights and enhanced penalties for violations
- Data retention: Necessity-based limitations
- Employee data: Expanded moratorium (to 2023)
- Service provider/contractor/third party: New obligations and clarifications (around written contracts)
Ballot Summary
Permits consumers to: (1) prevent businesses from sharing personal information; (2) correct inaccurate personal information; and (3) limit businesses’ use of “sensitive personal information”—such as precise geolocation; race; ethnicity; religion; genetic data; union membership; private communications; and certain sexual orientation, health, and biometric information. Changes criteria for which businesses must comply with these laws. Prohibits businesses’ retention of personal information for longer than reasonably necessary. Triples maximum penalties for violations concerning consumers under age 16. Establishes California Privacy Protection Agency to enforce and implement consumer privacy laws, and impose administrative fines. Requires adoption of substantive regulations.
Full Text of the Ballot Initiative
We’ll keep you posted.
