CPRA Key Takeaways

As was the case with the California Consumer Privacy Act (CCPA), there are still a lot of details to be resolved in the coming months to ensure the California Privacy Rights Act (CPRA) can be fully operational in 2023. However, quite a few of the changes are already clear that organizations need to plan for.

• The Right to Deletion included in the CCPA will be extended
• Businesses may not ‘punish’ a consumer for exercising their individual rights under the CPRA if further clarified
• Consumers will be able to get access to more data than just the data collected in the 12 months preceding their request
• The data breach requirements are extended
• A new concept of sensitive personal information, that requires a higher level of data protection than regular personal information is introduced
• A Right of Correction that allows consumers to request the correction of inaccurate personal information is introduced
• The concept of purpose limitation into the law is introduced
• A new limitation relates to cross-context behavioral advertising and the use of so-called dark patterns is introduced
• A new enforcement agency in California, comparable to data protection supervisory authorities elsewhere in the world is introduced