California Privacy Rights Act (CPRA)

Consumer protection has been of paramount importance to both lawmakers and residents in California for a long time, resulting in extremely strong laws that limit what companies can do with customer data and personal information. One of these laws addressing digital privacy concerns is the California Privacy Rights Act (CPRA), a new consumer privacy law that recently went into effect. The data protection law was passed by California residents through a referendum on the ballot in the 2020 general election. The CPRA was intended to be the most comprehensive consumer privacy legislation in the United States. Along with the California Consumer Privacy Act (CCPA), the CPRA set the standard for government protection of data privacy rights.

To learn more about the California Privacy Rights Act and how it affects both consumers and businesses, keep reading.

Who Does the CPRA Apply to?

Any for-profit company that does business in the state of California and that has significant gross annual revenues is subject to the regulations of the California Privacy Rights Act (CPRA). Additionally, if a company solicits customers in California and collects their personal information at any point, the company may be required to comply with the statute.

The CPRA can also apply to third parties that have been given access to a consumer’s personal data. If a company shared your information with a third party and you subsequently requested that the information be corrected or deleted, the company must pass on the request to the third party. The same is true for service providers and contractors: a company that shares customers’ personal information with these individuals and/or entities must instruct them about the CPRA requirements, and any violations by these other parties could expose the company to liability.

Additionally, the CPRA doesn’t apply only to consumers. CPRA protections also apply to employees who work for companies that monitor and use their data.

What Is the California Privacy Rights Act?

The California Consumer Privacy Act (CCPA) was the first state privacy law. The California Privacy Rights Act (CPRA) amended the CCPA and made California’s privacy laws even more consumer friendly. At the same time, the CPRA also strengthened existing protections for consumers by requiring businesses to comply with much stricter consumer privacy regulations.

New Obligations for Businesses Under the CPRA

The California Privacy Rights Act (CPRA) imposed further obligations on companies that do business in California and collect personal information from customers. For example, the CPRA created new compliance rules for businesses. This includes the elimination of a previous rule that gave companies 30 days to “cure” any violations of the CCPA. Now, any company that violates the CPRA is subject to monetary penalties under the statute.

Additionally, under the CPRA, companies must take affirmative steps to protect customers’ personal information against data breaches. This means that companies must implement reasonable security measures to ensure that personal data is not illegally accessed by others.

Businesses are also required to perform annual cybersecurity audits to confirm that no breaches have occurred. Businesses must submit the results of these audits to the California Privacy Protection Agency, in addition to conducting regular risk assessments that weigh the benefits of collecting consumer information against the security risks.

CPRA Created New Consumer Privacy Rights

The CPRA formally created a number of new privacy rights for California consumers, including the following:

Consumers can opt out of sharing their personal information with businesses.
Consumers can opt out of allowing businesses to use their “sensitive personal information.” This includes the customer’s Social Security number, driver’s license, state ID card, passport, credit card or debit card, bank account, geolocation data, and emails or text messages. It can also include information about the customer’s racial or ethnic origin, religion, genetic data, health data, and sexual orientation.
Consumers have the right to correct any personal data that is inaccurate. This means that businesses must provide customers with a means to review and then correct wrong information.
Consumers can legally access information about how the company is storing and using their data, as well as the data retention period.

What Types of Data Are Protected by the CPRA?

Basically, the California Privacy Rights Act (CPRA) protects any information that could be used to identify an individual. This includes things like the person’s name, email address, Social Security number, driver’s license number, state ID card, passport number, bank account or other financial account numbers, credit card or debit card numbers, and physical address.

When a company collects this type of information from a consumer, the consumer has a legal right to be notified. Moreover, once notified, the consumer has the legal right to demand that the information be corrected or deleted.

Sensitive Personal Information Protected by the CPRA

Data security is paramount in an age when information can be misused so easily. That’s why the CPRA places even stricter requirements on companies that collect consumer data deemed to be “sensitive personal information.”

What Is “Sensitive Personal Information”?

The California Privacy Rights Act (CPRA) defines a consumer’s “sensitive personal information” as including any of the following:

Social Security number, driver’s licenses, state ID card, or passport.
Website or app log-in information.
Bank accounts, credit cards, debit cards.
Geolocation data that identifies the consumer’s location.
Race, ethnicity, or religion.
Sexual orientation.
Email or text messages.
Genetic data.

The CPRA can also be updated by lawmakers in the future to add more categories that would qualify for protection as sensitive personal information. This definitional flexibility is codified in the statute to “address changes in technology, data collection practices, obstacles to implementation, and privacy concerns.”

How Sensitive Personal Information May Be Used

The CPRA places limitations on how businesses may use customers’ sensitive personal information. A business can only use this type of information to the extent necessary to perform services or provide goods reasonably expected by the consumer. Any use beyond this scope violates the statute.

Disclosures About Sensitive Personal Information

The statute stipulates that businesses must provide clear disclosures about the fact that they are collecting this type of information, as well as disclosures about how the information will be used. For example, a business should create a link on its company website that informs consumers of the collection practices and that gives them the ability to opt out of the collection and/or sharing of their data.

The California Privacy Protection Agency Is Tasked with Enforcing the CPRA

Section 24 of the CPRA created the California Privacy Protection Agency (CPPA), a state agency that implements and enforces the consumer privacy law. The CPPA receives reports of privacy law violations and then conducts investigations to determine whether companies should be penalized under the statute.

The CPPA is not the only state agency that oversees and enforces the CPRA. The California Department of Justice is also heavily involved in enforcing the law and ensuring that consumer privacy rights are protected.

What Are the Penalties for Violations of the CPRA?

The CPRA imposed substantial monetary penalties for noncompliance by companies. These penalties include a fine of $2,000 for each violation.

The penalties may be increased in certain circumstances:

$2,500 for each negligent violation of the statute.
$7,500 for each willful violation of the statute.

Civil Suits Filed Under the CPRA

The original consumer privacy law, the California Consumer Privacy Act (CCPA), gave consumers whose personal data was compromised a private right of action to bring a civil suit against the company that failed to prevent the data breach and protect consumers against invasions of privacy. But there were limitations on what exactly qualified as a “data breach” under the old statute. Under the new customer privacy regulations of the California Privacy Rights Act (CPRA), the types of data breaches that may expose a company to civil liability are greatly expanded: if a business fails to protect customer information such as an email address, username, password, or security question, the business could be sued by the victim.

Contact the Los Angeles Consumer Protection Lawyers at Tauler Smith LLP

Are you a California resident? Did you visit a website that collected your personal information without authorization? Was your personal information exposed in a data breach? You may be eligible to recover statutory damages under the California Privacy Rights Act (CPRA). The experienced Los Angeles consumer protection attorneys at Tauler Smith LLP can help you file a complaint with the CPRA and possibly file a civil lawsuit for financial compensation.

Call us today at 310-590-3927 or send an email to schedule a free consultation.