COVID-19 arrives just as the first omnibus privacy statute in the United States, the CCPA became effective. Since its January 1 effective date, we continue to wait for finalization of the CCPA regulations and enforcement that was slated for July 1. In a pandemic environment, companies, employers, and public institutions are grappling, outside the HIPAA context, with unique privacy, data security, and cybersecurity implications of their responses to the coronavirus. From a compliance perspective, businesses are considering under what circumstances they can disclose consumer or employee health conditions or geolocation information in the service of greater public health. Other companies —and governmental institutions at every level—are confronting the very real, and often opportunistic threats to data security posed by aggressive thieves who use crises as cover to commit an assortment of cybercrimes. Privacy and security requirements vary by jurisdiction, so businesses should be mindful of potentially divergent and overlapping approaches and responsibilities as the situation continues to evolve.

We offer a few updates and practical tips for best practices to promote compliance with privacy and data security requirements.

Continue Reading CCPA & COVID-19: A Practical Guide to Addressing Privacy and Data Security Implications of the Coronavirus

On March 11, 2020, the California Attorney General published its second modification to the California Consumer Privacy Act (CCPA) proposed regulations (“Second Modified Proposed Regs”). The redline includes the Second Modification language in blue and green as well as the first modification edits that were issued on February 10, 2020 (“First Modified Proposed Regs”). Collectively, the First Modified Proposed Regs and the Second Modified Proposed Regs are referred to below as the “Modified Proposed Regs.” The redlined comparison between the originally proposed regulations and the Modified Proposed Regs can be found here. All citations below are to the Modified Proposed Regs posted on March 11, 2020.  In addition to changes to the regulations, the Attorney General added supporting documents and information, which can be found here.

Continue Reading Updated: Modifications to Proposed CCPA Regulations: 10 Take-Aways

The California Consumer Privacy Act of 2018 (CCPA) is a sweeping new privacy statute that grants rights to consumers and imposes corresponding obligations on subject businesses. The CCPA defines consumers to mean California residents, and generally defines “business” as for-profit entities that meet certain threshold requirements. Cal. Civ. Code § 1798.140(g) (consumer), (c) (business). The CCPA went into effect on January 1, 2020. Continue Reading Business Solutions for CCPA Compliance

The California Consumer Privacy Act (CCPA) officially went into effect on January 1, 2020. For a full discussion of how the CCPA and the Attorney General’s proposed regulations will impact businesses, see here. To comply with the law, businesses must implement technical solutions to the CCPA’s various notice, submission, verification, and opt-out of sale requirements. Here are a few technical updates to facilitate compliance with the CCPA. Continue Reading The CCPA Is Live: Here Are the Technical Updates You Can Make to Comply

On October 10, 2019, the California attorney general’s office released the long-awaited proposed regulations to the California Consumer Privacy Act (CCPA), which can be found here. The regulations are detailed and cover a lot of ground with respect to notice to consumers, handling and verifying consumer requests, rules regarding minors, and non-discrimination. Continue Reading The CCPA Proposed Regulations Are Finally Here

On Friday the 13th of September 2019—the last day of California’s Legislative Session—California lawmakers updated, finalized and sent six bills that would amend the California Consumer Privacy Act (CCPA) to Governor Newsom’s desk for signature. Despite months of efforts from various groups, the CCPA made it through the legislative session with relatively fewer changes than expected.

This update provides a brief overview of the six bills that made it out of both houses and how they will amend the CCPA. Read the full update here.

The CCPA grants consumers the right to request deletion of any personal information which a business has collected from the consumer. Cal. Civ. Code § 1798.105. It also requires a business to fulfill deletion requests, and to direct service providers to do the same, within 45 days of receiving a “verified” or “verifiable” request from the consumer. Cal. Civ. Code § 1798.140(y).

Continue Reading CCPA 12-Month Compliance Series Part 6: Retaining and Deleting Data

As we approach the California Consumer Privacy Act’s (CCPA) effective date of January 1, 2020, brick-and-mortar businesses that increasingly engage with consumers online will have to begin their compliance efforts. However, two challenges unique to brick-and-mortar businesses might hamper these efforts: (1) providing required disclosures to consumers before or at the point of data collection; and (2) knowing your data in a multi-channel environment.

The CCPA requires businesses to give consumers notice of their rights and/or data collection practices on three separate occasions: (1) in the online privacy policy [section 1798.130(a)(5)]; (2) “at or before the point of collection” [section 1798.100(b)]; and (3) in response to a verifiable consumer request. The later business obligation is straight forward. But providing privacy notices at or before the point of collection might be challenging for brick-and-mortar businesses.

Continue Reading Compliance Challenges for Brick-and-Mortars Under the CCPA

Is your business ready for the California Consumer Privacy Act?

The California Consumer Privacy Act (“CCPA”) is a sweeping new law that introduces a host of privacy rights for California consumers, as well as creates a series of robust obligations for certain businesses that collect personal information about those consumers.

Join us for CCPA Week: A series of webinars hosted by Perkins Coie’s Privacy & Data Security practice focused on getting your business ready to comply with this enigmatic statutory scheme. Attendees will receive an overview of the current state of legislative amendments, insight into the high burden of persuasion industries may face, and guidance on leveraging existing compliance and governance programs to build a global privacy program that incorporates responsible data usage and proactive privacy practices. Continue Reading Perkins Coie’s CCPA Week

The California Consumer Privacy Act (CCPA) imposes new transparency and disclosure obligations on businesses’ use, sale, and disclosure of consumer information. Businesses will need to honor requests from consumers to access their personal information, delete their personal information, and opt out of the sale of their personal information. “Personal information” is more broadly described in the CCPA than in any prior statute: that is, “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

Continue Reading Pseudonymized Personal Information on Blockchain Not Sufficient Under CCPA