In November 2020, California voters approved the California Privacy Rights Act (CPRA), a ballot measure that expanded protections already in place with the California Consumer Privacy Act (CCPA). The CPRA is set to come into effect on January 1, 2023.<\/p>\n
Both of these privacy acts will impact the privacy and data security landscape. Here are the key differences between the two.<\/p>\n
The CCPA governs any for-profit business doing business in California and meets one of the following requirements: has annual gross revenues that exceed $25 million; collects, buys, receives, sells, or shares the personal information of 50,000 or more consumers, households, or devices each year; or receives more than 50% of its annual revenues from selling personal information.<\/p>\n
The CCPA gave California residents these new privacy rights:<\/p>\n
Check out this blog post<\/a> if you want more information on the CCPA.<\/p>\n The CPRA, also known as Proposition 24, significantly expands on the provisions created in the CCPA. It strengthens California residents\u2019 privacy rights and tightens regulations on the use of personal information.<\/p>\n The CPRA also established the California Privacy Protection Agency to implement and enforce the CCPA and the CPRA. This new agency will be able to issue fines up to $2,500 per violation and\/or up-to $7,500 for intentional violations or violations involving minors.<\/p>\n While the CPRA goes into effect on January 1, 2023, it becomes fully enforceable on July 1, 2023. However, businesses will need to make sure any data collected after January 1, 2022 is compliant with CPRA.<\/p>\n The CPRA does not replace the CPPA. Instead, it amends key features and adds new protections:<\/p>\n The CPRA increases the threshold of the number of consumers or households they collect personal information from 50,000 to 100,000 and removes devices from the mix. The other two requirements (gross annual revenues of $25+ million and earning 50% or more of its annual revenues from selling or sharing personal information) remain the same.<\/p>\n The CPRA creates a new category of personal information: sensitive personal information (SPI). \u00a0This new category of information includes Social Security, state ID, driver\u2019s license, financial account information, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, non-public communication, genetic, biometric, and health data, and information about intimate relations or orientation.<\/p>\n Businesses may need to create new use, disclosure, and opt-out requirements to protect this information<\/p>\n CPRA introduces four new consumer privacy rights and modifies five existing rights. The new privacy rights include:<\/p>\n The modified rights include:<\/p>\n Some of the principles created for the GDPR, the consumer privacy act protecting EU residents<\/a>, \u00a0are now part of the CPRA including new limitations on data minimization, collection purpose, and storage. Businesses are only allowed to collect related information for their stated purpose, and\u00a0only keep them for the originally disclosed amount of time.<\/p>\n The CCPA and CPRA are the first comprehensive consumer privacy legislation in the United States and paves the way for other states to create similar privacy acts. In fact, two more are set to go into effect on January 1, 2023, as well: the Virginia Consumer Data Protection Act<\/a> (VCDPA) and Colorado Privacy Act<\/a> (ColoPA).<\/p>\n There are additional acts in development for Maryland, Oklahoma, Ohio, New Jersey, Florida, and Alaska. As more states explore creating legislation to protect consumer data, the federal government may create baseline legislation as well.<\/p>\n Even if your state of business has not implemented its own legislation, putting in the work to get into compliance is a smart move.<\/p>\n","protected":false},"excerpt":{"rendered":" In November 2020, California voters approved the California Privacy Rights Act (CPRA), a ballot measure that expanded protections already in…<\/p>\n","protected":false},"author":1,"featured_media":642,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[7,51,10],"tags":[28,94,95,79],"yoast_head":"\nWhat is the CPRA?<\/h3>\n
Key Differences between the CPPA and CPRA<\/h3>\n
Updates qualifying criteria of businesses<\/em><\/h4>\n
New classification of personal information<\/em><\/h4>\n
New and expanded consumer privacy rights<\/em><\/h4>\n
\n
\n
Adoption of select GDPR provisions<\/em><\/h4>\n
More consumer privacy acts to come<\/h3>\n