| Shortly after the California Consumer Privacy Act (CCPA) was signed into law (For a detail analysis of the CCPA, please read my previous blog post), California Legislature passed Senate Bill 1121 amending the CCPA on August 31st. SB 1121 was enrolled and presented to Gov. Jerry Brown for signature on September 12th, 2018. Besides making various technical and clarifying revisions of the CCPA, SB 1121, amongst other material changes to the CCPA, delays the implementation of the CCPA and grants significant exemptions from its applicability to the processing of personal data in the financial and health sectors, unlike Europe's GDPR. The amendments can be summarized as follows: | Author: Alexander Popescu, CIPP/E Managing Attorney Phone: +1.310.634.0910 Fax: +1.310.388.0447 e-Mail: alexander@intel-lex.com  |
Processing activities exempted from CCPA's applicability by SB 1121
Rather than making specific amendments that integrate within the current legislation, SB 1211 simply carves out from the applicability of the CCPA certain processing activities related to data handled pursuant to specific laws. As such, CCPA will not apply to:
- Medical information governed by the Confidentiality of Medical Information Act (CMIA) or protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 and the Health Information Technology for Economic and Clinical Health Act .
- Personal data collected by a provider of health care or HIPPA governed entity, to the extent the provider or covered entity maintains patient information in the same manner as medical information or protected health information in compliance with CMIA and HIPP.
- Information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, also known as the Common Rule, pursuant to good clinical practice guidelines issued by the International Council for Harmonisation or pursuant to human subject protection requirements of the United States Food and Drug Administration.
- The sale of personal information to or from a consumer reporting agency if that information is to be reported in, or used to generate, a consumer report.
- Personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, the California Financial Information Privacy Act or the Driver's Privacy Protection Act.
It is important for companies doing business in California to work with a privacy attorney to document all personal data handling practices, understand if any exemptions apply and create appropriate policies.
No notification to California's Attorney General required to proceed with a private action
CCPA does provide a very narrow right of private action when a consumer's personal information is disclosed pursuant to a data breach which is attributable to the company's failure to implement reasonable security measures. In its original form, CCPA required consumers to provide a notice to Attorney General within 30 days of filing a private action under the act, allowing the attorney general to respond in one of three ways: (1) Ignoring the notice and allowing the action to proceed; (2)instructing the consumer not to proceed; or (3) prosecuting the action itself. The bill removes the AG's role in acting as a filter for the private right of action under CCPA. However, consumers will still have to provide companies 30 days' notice prior to filing such an action.
Provides immediate effective date for CCPA, but delays enforcement as far as July 1st, 2020
SB 1121 preserves the operative date of the CCPA, which remains January 1st, 2020, but it provides the CCPA will come into effective date upon the bill being signed into law. The bill also pushes the data by which the Attorney General must publish implementing regulations to July 2nd, 2020 from January 1st, 2020.
The bill also delays the Attorney's General ability to enforce the act until July 1st, 2020. However, this new deadline may still not be far enough, considering the complexities of how personal data is handled across various industries. Companies doing business in California should not delay in retaining appropriate personnel to be prepared to handle the new requirements, especially since the AG's implementing regulations may be published close to the enforcement deadline.
[Update]
The bill was signed by gov. Brown on September 23rd and Chaptered by the Secretary of State.
Disclaimer:
This Blog/ Website is made available by Intel Lex for educational purposes only as well as to give you general information and a general understanding of the law, not to provide specific legal advice. By using this blog you understand that there is no attorney-client relationship between you and Intel lex. The Blog/Web Site should not be used as a substitute for competent legal advice from a licensed professional attorney in your state.
This Blog/ Website is made available by Intel Lex for educational purposes only as well as to give you general information and a general understanding of the law, not to provide specific legal advice. By using this blog you understand that there is no attorney-client relationship between you and Intel lex. The Blog/Web Site should not be used as a substitute for competent legal advice from a licensed professional attorney in your state.