California Attorney General Releases Revised Proposed Regulations

On Feb. 10, 2020, the California attorney general released a revised draft of its proposed implementing regulations for the California Consumer Privacy Act of 2018 (CCPA). The revised regulations feature a number of changes and clarifications relevant to businesses covered by the law, including in the following areas:

• Confirming that all consumer notices required by the law must be reasonably accessible to consumers with disabilities, including, where relevant, through compliance with industry standards such as the Web Content Accessibility Guidelines.
• Providing additional guidance on the manner through which business must make the new "Notice at Collection" available to consumers.
• Clarifying (and in some cases cutting back on) the information that must be included in the business's privacy policy, including clarifying the statements that must be made by businesses that do not sell consumers' personal information.
• Removing the requirement for businesses to provide a toll-free telephone number for consumers to submit requests to know and requests to delete, if the business operates exclusively online and has a direct relationship with the relevant consumer.
• Providing further guidance on methods for accepting consumer requests with respect to businesses that primarily interact with consumers in person or over the phone.
• Clarifying that, in connection with a consumers' request to know, a business is not required to exhaustively search its files and databases to track down all personal information held regarding that consumer (but only under certain specific circumstances).
• Adding a new requirement for businesses when they receive a request to delete from a consumer and cannot verify the consumer's identity (the business must now ask the requester if they wish to opt out of sales of the consumer's personal information instead).
• Removing the requirement for businesses to specify the manner by which they have deleted a consumer's personal information in response to a consumer's request to delete.
• Clarifying the (still limited) direct obligations that service providers have under the law.
• Confirming that user-enabled privacy controls, such as browser plugins or privacy settings that send "do not sell my info" signals to businesses, are valid methods for consumers to submit a request to opt out of sales of the consumer's personal information, and providing additional guidance on this topic.
• Removing the requirement for businesses that sell consumers' personal information to instruct each third party to which the business has sold consumers' personal information not to further sell the consumer's personal information. (The business is now only required to send this instruction to any third parties to which it has sold a consumer's personal information in the interim period between the time it receives a request to opt out of sales from the relevant consumer and the time the business has actually complied with that consumer's request.)
• Expanding on the additional disclosure requirements for super-large businesses that collect and process the personal information of more than 4 million Californians each year.
• Revising the guidance around responding to requests to know and requests to delete relating to household personal information.
• Prohibiting businesses from requiring consumers to incur additional costs (e.g., paying a fee to a notary to get an affidavit notarized) in order to verify the consumer's identity in connection with a request to know or request to delete (unless the business reimburses the consumer for such additional costs).
• Providing further illustrative examples of the law's non-discrimination requirements.

The revised proposed regulations will be subject to an additional public comment period running through Feb. 25, after which the proposed regulations may be further revised in response to the comments or the proposed regulations may be finalized. The text of the revised proposed regulations and further information about the rulemaking process may be found by visiting the California attorney general's website at https://oag.ca.gov/privacy/ccpa.

Robinson Bradshaw will be pausing its CCPA Practice Tip Series temporarily while we review and analyze the impact of the revised proposed regulations and work to update our previous guidance in the Series.