California Privacy Rights and Enforcement Act Amends California Privacy Protection Act

California Privacy Rights and Enforcement Act Amends California Privacy Protection Act

On November 3, 2020, California voters passed the California Privacy Rights and Enforcement Act (CPRA), which amends and fortifies parts of the existing California Consumer Privacy Act (CCPA) in a number of key respects. From an enforcement perspective, the CPRA will pave the way for the creation of the California Privacy Protection Agency to ensure that covered businesses comply with the CCPA’s requirements. In addition, covered businesses will be subject to certain accountability measures, including a requirement to conduct privacy risk assessments and cybersecurity audits for submission to regulators. The CPRA also adds a new category of “sensitive data” that will be subject to heightened data privacy requirements, including use and disclosure limitations. Despite the heightened obligations imposed on covered businesses, the CPRA extends the moratorium on employee data first introduced through Assembly Bill 25 from January 1, 2021 to January 1, 2023.