Section by Section Summary of the CPRA

Preamble emphasizes California Constitution’s right to privacy. Intent of law is to prevent the Legislature from weakening privacy protections while allowing the Legislature to strengthen them over time. Discussion of state interest in protecting consumers, who are realistically unable to manage all their privacy settings to protect themselves, when many businesses are actively trying to make this difficult.

First principles of privacy: purpose limitation, storage limitation, data minimization, requirements for a chain of custody when personal information is sold or shared, requirement for reasonable security.

Consumers have a right to delete their information (except in limited circumstances where businesses need to keep the information to complete a transaction, ensure security, exercise free speech etc.).

Consumers have a right to correct their inaccurate information held by businesses.

Consumers have a right to see what personal information businesses have collected about them, where it came from, why the business is selling it, where it is being disclosed.

Consumers have a right to know what personal information of theirs is being sold or shared, and with whom. 3rd parties may not resell or re-share personal information unless the consumer has received notice and has the right to opt out.

Consumers have the right to opt out of the sale of their information, also to opt out of its sharing for advertising. Guardians of children under 13, and consumers from 13 to 16, must opt in to the sale of their information.

Consumers can drastically limit the use and disclosure of their sensitive personal information, including race, religion, sexual orientation, health, precise geolocation, etc. The only exception is when a business delivers a product to a consumer which the consumer him/herself requested, and when the information would be used in a way reasonably expected by an average consumer.

Businesses may change service levels, offer financial incentives, or charge an opted-out consumer more, but there are strict limitations on such difference in service levels: the change or price difference must be reasonably related to the value provided to the business by the consumer’s data. Prevents businesses from imposing extreme financial or operational hurdles on a consumer who wants to prohibit the sale of their information.

Specific details/provisions with respect to these rights.

Defined terms.

Exemptions from the law.

Permits private right of action in the event of negligent data breach, i.e. if a business has not redacted or encrypted consumers’ personal information and suffers a data breach.

Provides for penalties of $2,500 per violation and up to $7,500 per intentional violation. Allows for enforcement of the law by the California Privacy Protection Agency, by the Attorney General, and by any District Attorney in any county in California, as well as the City Attorneys in the 4 largest cities in the state (by repealing language in CCPA that gave the Attorney General exclusive authority).

Funds from fines go first to offset costs of enforcement, then 91% to a “lockbox” fund managed by the State Treasurer, whose interest is available to the state’s general fund. 9% of proceeds shall be made available for grants in California to nonprofits associated with privacy/data breaches.

The law applies to all businesses doing business in California, not simply businesses that collect information electronically, or over the Internet. This law should be harmonized with other consumer privacy laws, and whichever offers consumers the most protection, should control.

This state law preempts local laws.

California Privacy Protection Agency is given rule-making authority “as necessary to further the purposes of this title.” Specific directions include:

Avoidance actions taken in series to try to avoid the scope of this act shall be disregarded for the purpose of enforcing the Act.

No contract may waive or limit a consumer’s rights under this title.

New state agency is established with guaranteed minimum funding of (2021–22) $10 million per year indexed to CPI. Will allow for hiring ~ 50 privacy professionals, (25% more than the FTC has for the entire country).

No amendments are permitted unless they further the purpose and intent of the act (section 3). I.E., a one-way ratchet: the law can be amended to become more privacy protective, but not less.

The Act is severable.

N/A, no other privacy-related measure was placed on the ballot in 2020.

Other agencies can defend the constitutionality of the law in court.

The act shall be construed liberally.

The act is not intended to preempt federal law or the California Constitution.

Related posts:

This series of blog posts will show you how to replicate a search topic in four database platforms and raise awareness of some of the search tools that may be useful in replicating searches. These…

There is a Sunday morning fragrance in the air that brings back a rush of memories from different towns. I pop into A.’s house next door. His parents are watching Chandrakanta and he is in another…

Stablecoins are quickly becoming the holy grail in cryptocurrency, promising both a safehaven where value can be stored during volatile periods in the market, and a trustworthy means to transact…