NAVIGATING NEW REGULATIONS FOR CCPA
CD: Could you explain why the California legislature modified its California Consumer Privacy Act (CCPA) by enacting the California Privacy Rights Act (CPRA)? What factors drove the changes?
Leipzig: The CCPA was motivated by a desire of the proponents of the statute to strengthen the law, align it more closely with the European Union’s (EU’s) General Data Protection Regulation (GDPR), and close what consumer advocates perceived as ‘loopholes’ in the original CCPA related to AdTech. The proponents of the new law were focused on three key motivations. First, eligibility for California to be considered an ‘adequate’ territory. The EU considers privacy to be a fundamental human right. As such, for personal data to be transferred, there must be ‘adequate’ protections for privacy and security in the countries where data is transferred by law. There are only a handful of countries that have received adequacy determinations, and the US is not one of them. Recently, considering the Schrems II decision, there has been much press about how the EU considers the US’s privacy protections to be inadequate, requiring special measures, such as contractual provisions and binding corporate rules, or legislative exemptions, known as derogations, to the general rule that personal data cannot be transferred to the US. The amendments in the CPRA, to include sensitive data protections, human resources (HR) and business-to-business (B2B) data exemptions, correction rights, and data minimisation concepts, have been designed to bring the California law more in line with the GDPR in order to achieve ‘adequacy’. An adequacy decision for California would be precedent setting, as the EU has never deemed a ‘territory’, rather than a country, to be adequate. In addition, if the CPRA achieves this, it would instantaneously transform California into a hub for international transactions that Wilbur Ross, former chairman of the Department of Commerce, estimated to be over $7 trillion a few years ago.
Apr-Jun 2022 issue
Perkins Coie