Thought Leadership

Here We Go Again - Third Set of Proposed Regulations to the CCPA

Client Updates

The California Office of the Attorney General (“Attorney General”) has submitted a third set of proposed regulations implementing the California Consumer Privacy Act of 2018 ("CCPA").  By way of background, the California Office of Administrative Law (“OAL”) approved as final the current set of regulations on August 14, 2020 (“Final Regulations”).  This approval, though, excluded certain sections that the Attorney General initially submitted but later withdrew for consideration from OAL review. Now, the Attorney General’s third set of proposed modifications largely provides for additions to the current Final Regulations, which comes less than a month before the California Privacy Rights Act (“CPRA”) will be put to vote on the statewide general election on November 3, 2020.

We summarize the proposed modifications here. The deadline for public comment on these proposed modifications is not later than 5:00 PM PST on October 28, 2020:

  • Offline Notices of Opt-Out Rights: Currently, the Final Regulations (999.306(b)) requires a Business to provide notice of the right to opt-out if the Business sells consumer’s personal information. Proposed subsection 999.306(b)(3) accounts for non-website consumer interactions by clarifying that the Business must also provide notice “by an offline method” if the business collects personal information “in the course of interacting with consumers offline.” The proposed modification provides additional examples and clarifies that “brick and mortar” operations may provide notice through signage in the area where the Business collects personal information or, if a Business collects personal information over the phone, it may provide notice to the consumer orally during the call.
  • Consumer Opt-Out Requests: Proposed subsection 999.315(h) provides additional guidelines for how a Business enables a consumer to submit a request to opt-out, including language that the business “shall not” use a method that “has the substantial effect of subverting or impairing a consumer’s choice to opt-out.” The proposed modification includes illustrative examples and clarify that a Business may not require a consumer to search or scroll through the text of a privacy policy or similar document or webpage to locate the mechanism to submit the opt out request after clicking the “Do Not Sell My Personal Information” link. In other words, the modification would require that Businesses make the process to submit a request to opt-out easy to execute and with minimal steps.
  • Authorized Agent Requests: The proposed modification to subsection 999.326(a) relates to the use of an authorized agent to submit opt-out requests on a consumer’s behalf. The proposed modification would require a Business to ensure that an authorized agent provides proof that a consumer gave the agent signed permission to submit the request. As an added verification layer, the modifications will also allow the Business to require the consumer to either: (1) verify their own identity directly with the Business; or (2) directly confirm with the Business that the consumer provided the authorized agent permission to submit the request. This provides a degree of deference to the Business when complying with requests from authorized agents.
  • Opt-In Process: The proposed modification to subsection 999.332(a) clarifies that a Business must provide a description in its privacy policy of the opt-in process when the Business sells personal information of consumers under 16 years of age (e.g., Businesses that are subject to sections 999.330 or 999.331).

To view the redline of the Attorney General’s proposed modifications, click here.

To view the Attorney General’s notice summary of proposed modifications, click here.

For additional information or support on your CCPA compliance initiatives, contact Cynthia Cole or Matthew Baker in the Baker Botts Privacy and Data Security team.

 

 

ABOUT BAKER BOTTS L.L.P.
Baker Botts is an international law firm whose lawyers practice throughout a network of offices around the globe. Based on our experience and knowledge of our clients' industries, we are recognized as a leading firm in the energy, technology and life sciences sectors. Since 1840, we have provided creative and effective legal solutions for our clients while demonstrating an unrelenting commitment to excellence. For more information, please visit bakerbotts.com.

Related Professionals