As of November 6, 2020, it appears that California voters have approved Proposition 24, which will expand the reach and enforcement of the already groundbreaking California Consumer Privacy Act. With three-quarters of the anticipated votes counted, the measure is up by 1.5 million votes, a lead that is unlikely to be overtaken.
For California businesses already struggling to comply with the CCPA, this means that there is even more work ahead. The Proposition expands consumer rights under the CCPA, while also increasing likely enforcement of consumer privacy rights. In addition, these new requirements will demand a more active approach to CCPA compliance; to the extent a business is currently relying on a cookie-cutter compliance program, it will need to make dramatic and tailored changes to comply with the new law.
Proposition 24 requires qualifying businesses to do all of the following:
- honor customer’s requests not to share personal information
- provide consumers with an opt-out option for having their sensitive personal information, as defined in law, used or disclosed for advertising or marketing
- obtain permission before collecting data from consumers who are younger than 16
- obtain permission from a parent or guardian before collecting data from consumers who are younger than 13
- correct a consumer's inaccurate personal information upon the consumer's request
In addition, Proposition 24 establishes the California Privacy Protection Agency that would have the administrative power, authority, and jurisdiction to implement and enforce the consumer privacy laws. Currently only the California Attorney General has this authority, and the 2018 CCPA did not provide any additional funding for the AG’s office to carry out this authority.
The new Agency would be governed by a five-member board, with the chair appointed by the governor. The remaining four members would be appointed by the governor, attorney general, Senate Rules Committee, and speaker of the assembly. Proposition 24 will require the legislature to appropriate $10,000 million to the CCPA during each fiscal year.
Every business that must comply with the CCPA will need to make changes to their program to be compliant with Proposition 24. The law will go into effect starting January 1, 2022, but just as the current CCPA requirements took most businesses months to comply with, as will these new requirements. In the coming weeks keep an eye out for more guidance from Scali Rasmussen as we help you to understand what the new law will mean for your business.