California Privacy Rights Act (CPRA)
The California Privacy Rights Act (CPRA) sunsets on January 1, 2023, and largely amends, and augments the CCPA, bringing landmark legislation to both enhance Californians’ protection and impose new compliance requirements on businesses.
Scope and Applicability of CPRA
The CPRA will apply to world for-profit entities meeting the threshold requirements. A business shall be obligated when its processing entails personal information of more than 100,000 California residents annually or where a business’s gross revenue is in excess of $25 million. Companies that earn more than 50% of their income from the sale or exchange of California residents’ personal information will also be subject to CPRA.
Key Rights Under CPRA
Multiple rights are conferred to Californian residents, who are otherwise referred to as “consumers,” namely:
- Right to Opt-Out: An individual can opt out of having their personal information sold or shared with third parties.
- Right to Terminate: One can obtain information that is related to the collection of personal information from them.
- Right to Deletion: A consumer can request the deletion of personal data.
At the point of collection itself, businesses have to notify about the types of personal information collected and its purposes. Also, there needs to be a clear “Do Not Sell My Personal Information” link for opting out from sale.
- For your website to sell the information of minors below 16 years, you have to procure explicit consent.
Requirements of Privacy Policy
Businesses have to update their privacy policies, which include:
- A description of consumer rights and how to apply.
- Annually, an updated list of the categories of personal data it has collected, sold, and shared.
- Access to Data and Non-Discrimination
At the consumer’s verifiable request, a business shall provide access to all personal information it has held during the 12 months prior without charge and indicate sources and recipients of third-party data. In addition, a business cannot discriminate against a consumer for the exercise of the rights of a CPRA consumer.
Personal Information Definition of CPRA
The CPRA broadly defines personal information. Personal information, under the CPRA, shall cover data identifying or linkable with an individual or household, inclusive of their names, addresses, telephone numbers, and online identifiers like cookies.
Data Collection and Cookies
The use of cookies, in particular third-party cookies, is traced to personal data and preferences and therefore considered as personal information under CPRA. Companies should pay a lot of attention to the use and management of cookies due to compliance considerations.
Comparison with GDPR and CPRA
The CPRA is, in most ways, similar to the General Data Protection Regulation of the European Union but acts in the jurisdiction of California’s legislation. The two share a significant platform on consumer rights, data access, and protection. However, they have some differences: the GDPR has provisions for cross-border data transfers, while CPRA refers particularly to the sale and sharing of personal information.
CPRA requirements are important to understand and implement for any business dealing with Californian data in order to ensure compliance and consumer privacy protection.
Check the original article for detailed information.
