California Amends Provisions Regarding Consumer Privacy Act
The amendment clarifies that the California Consumer Privacy Act, which was set to become operative on January 1, 2020, will go in effect immediately upon the bill being signed into law in order to prevent confusion created by the enactment of conflicting local laws regarding the collection and sale of personal information prior to the January 1, 2020 operative date.
The amendment provides that that the rights afforded to consumers and the obligations imposed on any business under the act do not apply if those rights or obligations would infringe on the noncommercial activities of people and entities described in subdivision (b) of Section 2 of Article I of the California Constitution.
The amendment prohibits application of the act to personal information collected, processed, sold, or disclosed pursuant to a specified federal law such as the Gramm-Leach-Bliley Act, the Driver’s Privacy Protection Act, and the California Financial Information Privacy Act.
The amendment revises and expand the exemptions provided for medical information and exempts a provider of health care or an entity governed by the Health Insurance Portability and Accountability Act and also exempts information collected as part of clinical trials, as specified.
The amendment provides that the only private right of action permitted under the act is the private right of action for violations of unauthorized access and exfiltration, theft, or disclosure of a consumer’s non encrypted or non-redacted personal information where the breach was caused by the company’s failure to maintain reasonable security measures.
The amendment further provides that there is no private right of action when the company cures the alleged violation within thirty days and provides the consumer an express written statement that the violations have been cured and no further violations of the act shall occur.
A consumer bringing a private right of action is not required to notify the Attorney General; however, a consumer is still required to notify a business of any violations he or she detects 30 days before initiating an action against the company.
The amendment revises timelines and requirements regarding the promulgation of regulations by the Attorney General in connection with the act. The amendment prohibits the Attorney General from bringing an enforcement action under this title until six months after the publication of the final regulations issued or July 1, 2020, whichever is sooner.
Rhona Kyeyune, LLM, is a regulatory compliance consultant with CLA. She is a graduate of Makerere University and earned her master of laws at Boston University School of Law.
Comments are closed.