New CPRA Regs are here again!

What is NOT Consent:

• A choice where the “yes” button is more prominent (e.g., larger in size or in a more eye-catching color) than the “no” button is not symmetrical (same as per European Data Protection Board Guidelines on Dark Patterns).

• A choice where the option to participate in a financial incentive program is selected by default or featured more prominently (e.g., larger in size or in a more eye-catching color) than the choice not to participate in the program is neither equal nor symmetrical

• A consumer’s silence or failure to act affirmatively is not consent (also same for #GDPR)- Acceptance of Terms of Use

• A consumer closing a pop-up window on a website that requests consent without first affirmatively selecting the equivalent of an “I accept” button - Choices driven by a false sense of urgency e.g A countdown clock displayed next to a consent choice which states “time is running out to consent where the discount is not actually limited by time or availability is misleading.

• The list of examples is non exhaustive

Privacy notice

• You need to describe the categories of personal information in a manner that provides consumers a meaningful understanding of where the information is collected and with whom it is shared.

Notice of Right to Opt-out of Sale/Sharing

Should be provided manner that ensures that the consumer will encounter the notice before (1) in a connected device (e.g., smart television or smart watch) before the device begins collecting the personal information that it sells or shares. (2) in AR/VR - before the consumer enters the augmented or virtual reality environment.

Notice of Right to Limit:

Should be provided in the same manner in which it collects the sensitive personal information that it uses or discloses for purposes other than those specified

• If offline then by an offline method (e.g., on the paper forms that collect the sensitive personal information or by posting signage in the area where the sensitive personal information is collected directing consumers to where the notice can be found online).

• If on the phone, the verbally during the call

• If through a connected device (e.g., smart television or smart watch) - then in a manner that ensures that the consumer will encounter the notice before the device begins collecting the personal information

• If in augmented or virtual reality, such as through gaming devices or mobile applications - then in a manner that ensures that the consumer will encounter the notice before the consumer enters the augmented or virtual reality environment.

New Obligation re: filing a complaint

When denying a request in whole or in part, new duty to Inform the consumer that they can file a complaint with the Agency and the Attorney General and provide links to the complaint forms on their respective websites. For example, the business can include the following language in its response to the consumer: “If you believe your privacy rights have been violated, you can submit a complaint to the California Privacy Protection Agency at [link to complaint form] or to the California Attorney General at [link to complaint form].

Right to know:

• If a business maintains personal information for longer than 12 months, its method for submitting requests to know shall include a means by which the consumer can request that the business provide personal information collected prior to the 12-month period preceding the business’s receipt of the consumer’s request. For example, asking the consumer to select or input the date range for which the consumer is making the request.

• When responding to a request to know sensitive information which cannot be disclosed, you need to provide a way for the consumer to confirm that the personal information the business maintains is the same as what the consumer believes it should be [same as GDPR]

Right to delete:

• Affirmative obligation on the business and on service providers to implement measures to ensure that the information remains deleted, deidentified, or aggregated. [Practice note: document the measures; ask for your providers' measures]

• This includes considering and addressing the possibility that deleted information may be re-collected by the business (e.g. from data brokers) [This seems to be broader than the requirements for right to delete under GDPR]

Right to Correct:

• New duty for business and service providers to implement measures to ensure that the information remains corrected.

• This includes the duty to ensure that the corrected personal information is not overridden by inaccurate personal information subsequently received from the data broker.

• You may delay compliance with a consumer’s request to correct with respect to data stored on an archived or backup system until the archived or backup system relating to the personal information at issue is restored to an active system or next accessed or used for a sale, disclosure, or commercial purpose.

• New duty to Inform the consumer that, upon the consumer’s request, you will note both internally and to any person with whom it discloses, shares, or sells the personal information that the accuracy of the personal information is contested by the consumer.

Right to opt out:

• Opt out preference signal: you must but display the status of the consumer’s choice

• You need to comply with the opt out request as soon as reasonably possible and not within 15 days. For example, this means immediately if you are selling/sharing through real time bidding.

Insurance companies

Insurance companies that meet the definition of “business” under the CCPA shall comply with the CCPA with regard to any personal information that they collect, use, process, or retain for purposes not subject to the Insurance Code, e.g. re personal information that is used for purposes not in connection with an insurance transaction.   insurance transaction.

Article provided by INPLP member: Odia Kagan (Fox Rothschild LLP, United States)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)