LEGAL UPDATE: California Consumer Privacy Act and California Privacy Rights Act
by Michelle Bomberger | April 20, 2023Equinox Business Law Leagal Update: The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) created new privacy rights for consumers and data protection obligations for businesses operating in California. The CPRA, which went into effect on January 1, 2023, includes additional protections for consumers, employees, and small and non-profit businesses, and establishes a new government agency for data privacy enforcement. The CPRA applies to businesses with a gross annual revenue exceeding $25 million, those that buy, sell, or share personal information of more than 100,000 consumers or households per year, or those that derive 50% or more of their annual revenues from selling or sharing consumers' personal information. Businesses need to update their collection notices, privacy policies, opt-out notices, and financial incentive notices and implement proactive risk-based controls. The best way to prepare for compliance is to perform a data audit, map out data flows, construct a privacy policy, and establish good data hygiene processes.