On June 28, 2018, California enacted the California Consumer Privacy Act of 2018 (“CCPA”). The CCPA was hastily drafted and adopted in order to meet a deadline imposed by the sponsors of a ballot initiative set to be voted on in November. The sponsors of the ballot initiative had agreed to withdraw the initiative if California passed a consumer privacy act prior to June 29th, and the sponsors did so after the enactment of the CCPA.
Given the hasty nature of the enactment, it was expected that the act would be modified prior to the act’s effective date of January 1, 2020 to strengthen the act and remove some errors. On August 31, 2018, the California legislature passed Senate Bill (“SB 1121”) as the first amendment of the CCPA.
Below is a summary of some of the notable changes to the CCPA under SB 1121:
- Though the effective date remains January 1, 2020, under SB 1121, the California Attorney General may not bring an enforcement action under the CCPA until July 1, 2020 or the date that is six months from the Attorney general’s publication of final implementing regulations for the CCPA, whichever comes first.
- The CCPA allows for private rights of actions. SB 1121 limits these private rights of action only for a business’s failure to implement and maintain reasonable securities and practices that result in a breach.
- The amendment clarifies the definition of “personal information”, so that it only includes information if it “identifies, relates to, describes, is capable of being associated with, or could easily be linked, directly or indirectly, with a particular consumer or household.”
- The amendment clarifies that data collected, processed, sold or disclosed pursuant to the Gramm-Leach-Bliley Act and the Driver’s Privacy Protection Act or the California Information Privacy Act is exempt from the CCPA.
More substantive amendments to the CCPA are expected when the California State Legislature reconvene in January 2019.