California Privacy Law Updates

California Privacy Law Updates

On June 24, 2020, the California Secretary of State announced that the California Privacy Rights Act (CPRA) met the requirements to appear on the State's November 3, 2020 General Election ballot. If voted into law, it would significantly expand existing law and create new privacy obligations for covered businesses. Most notably, the CPRA would shift enforcement authority for violations of the CCPA from the California Attorney General to a newly formed California Privacy Protection Agency. In addition, the CPRA expands the CCPA’s private right of action for personal information security breaches by including unauthorized access or disclosures of an email address and password or security question that would permit access to an account if the business failed to maintain reasonable security. Despite the heightened obligations placed on covered businesses, the CPRA would extend the moratorium on employee data first introduced through Assembly Bill 25 from January 1, 2021 to January 1, 2023. In the event the CPRA fails to receive the necessary votes to become law, the legislature is considering Assembly Bill 1281, which seeks to extend the moratorium on employee data to January 1, 2022.