Third Set of Draft CCPA Regulations Released For Comment

First things first, if you would like to receive my Technology Policy Update, email me. You can find some of these Updates from 2019 here.

The California Attorney General’s Office (OAG) has released a third iteration of draft regulations to implement the “California Consumer Privacy Act” (CCPA) (AB 375) and is accepting comments by email or U.S. mail until 5:00 pm PDT on March 27 (See here for a clean copy and here for a redline.)Of course, the CCPA requires that regulations be in place by July 1, 2020.

The OAG explained that it “first published and noticed the proposed regulations for public comment on October 11, 2019…[but] [o]n February 10, 2020, the Department gave notice of modifications to the proposed regulations, based on comments received during the 45-day comment period.” The OAG stated that it “received around 100 comments in response to the modifications…[and] [t]his second set of modifications is in response to those comments and/or to clarify and conform the proposed regulations to existing law.”

Most of the changes are marginal. However, there a few notable modifications. Among the notable deletions, the OAG removed the section with an illustration on what an acceptable opt-out toggle button might look like. Additionally, the revised draft regulations strike the section that clarifies what could qualify as “personal information” that triggers many of the responsibilities and obligations under the CCPA.

In terms of new language, the draft regulations make clear that regarding a business’s notice responsibilities, “[a] business that does not collect personal information directly from a consumer does not need to provide a notice at collection to the consumer if it does not sell the consumer’s personal information.” Additionally, an entity’s privacy policy regarding a person’s right to know about personal information collected, disclosed or sold must contain two additional items:

• the categories of sources from which the personal information is collected. The categories shall be described in a manner that provides consumers a meaningful understanding of the information being collected.
• the business or commercial purpose for collecting or selling personal information. The purpose shall be described in a manner that provides consumers a meaningful understanding of why the information is collected or sold.