Last month the California Attorney General announced that the Office of Administrative Law has approved the final California Consumer Privacy Act (CCPA) regulations. The final draft, submitted to OALL in late June of this year, is substantially the same as the final version, with minor tweaks that impact brick-and-mortar retailers. If your business has been waiting until final regulations to comply with the law, now is the time.
According to AG Becerra’s announcement, “With these rules finalized, California breaks ground and leads the nation to protect and advance data privacy. These rules guide consumers and businesses alike on how to implement the California Consumer Privacy Act. As we face a pandemic of historic proportions, it is particularly critical to be mindful of personal data security.”
The major change in the final version of the regulations for retailers is the removal of the explicit requirement that brick-and-mortar retailers find a way to provide notices in store. While this should be a relief to businesses such as car dealers, it does not mean that they can fail to provide customers with notice of their privacy practices. We continue to recommend that businesses post notices directing consumers to the business website to learn more about their privacy options.
Another change that could have a lasting impact is the removal of the requirement that businesses seek explicit consent to use data collected from the consumer for a “materially different” purpose than the ones disclosed in privacy notices. This means that while businesses must disclose to consumers the categories of information collected and the business purposes for that collection, the business may use consumer information that fits into a disclosed category for any legal purpose – or at least so it seems. This may be a source of litigation if businesses abuse this change.
With the finalization of the regulations, all eyes now turn to the AG’s office to see how it will enforce the law. In addition, Proposition 24 will be on the ballot this November and would impose significant new requirements on businesses. Every qualifying business should now comply with the law and be prepared for continuing changes.