In the midst of an unprecedented presidential campaign, you might have missed that California’s Proposition 24, also called the California Privacy Act (CPRA), was poised to amend the California Consumer Privacy Act (CCPA) a mere three months after Attorney General Xavier Becerra approved the final regulations for the CCPA.

On November 3, California voters approved the CPRA by a count of 56% (YES) to 44% (No). In July, we discussed the CPRA’s proposed changes to the CCPA, such as creating sensitive personal information as a second category of information. The CPRA also creates additional rights to consumers, additional obligations of businesses that apply to the CPRA, an increased focus on “sharing” information for behavioral advertising and the creation of a new governing entity to enforce the CPRA.

The CPRA is set to become effective on January 1, 2023, when the CCPA’s compliance requirements for the personal information of employees and business contact requirements will also finally go into effect. We expect other states to follow California’s example and enact stricter privacy laws due to consumer pressure and other privacy advocacy groups. Stay tuned for more on this topic and others as privacy and security continues to be at the forefront of emerging law and business.

Taft partner Scot Ganow will be one of the presenters for “What we wish clients would do about business email compromise,” on Oct. 29, 2020. The one-hour seminar brings together cybersecurity and risk management professionals to examine business email compromise including a real-world case study, the ramifications of an attack, and how to arm your business against would-be opportunists.

Register to attend here.

In a surprising turn of events, the Brazilian Senate has revised executive order MP 959/2020 to remove the delayed effective date of Brazil’s General Personal Data Protection Law (“Lei Geral de Proteção de Dados” or “LGPD”). As we previously discussed in Taft’s Privacy & Data Security Insights blog, Brazil had originally delayed the implementation of LGPD to have an effective date of January 2021. However, during a remote session on August 26, 2020, the Brazilian Senate rejected the proposed delay by the Brazilian Chamber of Deputies (the lower house of Brazil’s National Congress) and set an enactment date of August 27, 2020. Upon the Brazilian president’s signature of MP 959/2020, LGPD will become effective immediately.

It should be noted that administrative sanctions and penalties for LGPD violations will continue to be delayed until August 2021. As a reminder, under LGPD, the newly created Brazilian National Data Protection Authority (“ANPD”) would oversee personal data protection measures, allowing data subjects to submit claims or complaints directly to the ANPD. Although the ANPD would not be able to bring enforcement actions until August 2021, LGPD—once sanctioned by the President—allows citizens and data subjects to immediately claim violations of their privacy rights through legal action in Brazil’s court system.

The immediate enactment of LGPD is unusual given the fact that it was delayed from its original August 16, 2020 effective date by the Brazilian Congress and President due to the global impact of the COVID-19 pandemic. Despite the ongoing pandemic, Brazil’s leadership appears ready to now move forward with LGPD’s data protection measures. Unfortunately, this means that entities processing relevant personal data will need to ensure they comply with LGPD and follow the ANPD’s guidelines in the ensuing months—while they deal with the impact COVID-19 is having on their businesses. Taft’s Privacy and Data Security Practice and COVID-19 Task Force will continue to update you and our clients on the appropriate measures to take while navigating the challenges of 2020.

Since we originally posted this content to Taft Privacy & Data Security Insights, the governor of California has since signed AB1281, extending the exemptions for employee personal information and that of business contacts until January 2022.  This deadline may be extended again, should voters choose the CPRA, as discussed below.

*  *  *

An important development on the California Consumer Privacy Act (CCPA) front occurred as many of us enjoyed the last days of summer and readied for the Labor Day weekend.  The California state legislature passed a bill to extend two compliance deadlines for businesses processing applicable employee information and that of business contacts.  Currently businesses are expected to be in compliance with the CCPA for personal information for employee and business contacts on January 1, 2021.  Under Assembly Bill 1281, businesses would have until January 1, 2022 to meet the CCPA obligations.

All of this is subject to the pending vote in November on the California Privacy Rights Act, or CPRA.  If the CPRA passes, Assembly Bill 1281 will be rendered inactive and the exemptions will still be extended until January 1, 2023.

While we all expect the governor to sign AB 1281, nothing is guaranteed—especially in 2020!  If the bill is not passed into law and the CPRA fails at the ballot box, businesses will have to be CCPA “compliant” for employee information and business contact information effective January 1, 2021.  We will keep you posted here on Taft’s Privacy & Data Security Insights.

Taft partners Scot Ganow and Phil Schenkenberg will be featured speakers for the “Cybersecurity for In-house Legal Counsel” Seminar on Oct. 26. The virtual seminar will help in-house counsel understand the legal constructs and terminology widely used within the cybersecurity space, and to provide practical ways they can be more responsive and efficient when cyber issues arise. Taft is a sponsor of the event.

Ganow will present “Legal Overview and Key Cyber Risks for Businesses,” which covers the laws, regulations, standards, and best practices affecting not only an organization’s obligations but its opportunities with its most powerful asset:  Its Data.

Schenkenberg will moderate the panel discussion “Governance and Working Relationship Considerations in Privacy and Data Security.” The panel will explore how governance structures and relationship building within the C-suite can drive success in meeting privacy and security goals.

Register to attend here.

After months of public comment and sporadic guidance issued by the California Attorney General’s Office, at long last we have the final regulations under the California Consumer Privacy Act, which have been approved by the Office of Administrative Law and filed with the Secretary of State’s Office. The regulations go into effect immediately, and include changes and withdrawn proposals that range from typographical to impactful.

The California Attorney General’s office has characterized the changes to the CCPA text as “non-substantive,” and has withdrawn certain proposed provisions “for additional consideration.” The non-substantive changes are designed to improve consistency in language, and are described in detail in the Addendum to the Final Statement of Reasons. Some withdrawn provisions, however, could impact companies expected to comply with CCPA. We discuss some notable sections below.  Continue Reading Things Just Got Real: California Approves Final CCPA Regulations

Thank you, reader, for taking time out of your day to read this blog post. I trust before clicking on this link you first sought out our website’s Privacy Policy and reviewed it in full, took mental notes while silently nodding throughout, and finished with an audible “I agree” before moving on to review this content. Correct?

Very likely you did not, but take solace in knowing you are in good company. Only 22% of Americans report “often” or “always” reading online privacy policies, and that’s solely for websites which require browsers to affirmatively agree to a privacy policy (i.e., flashing a pop-up with some form of “check the box” affirmation). This does not engender much confidence that Americans are actively seeking out and consenting to the privacy policies embedded within the myriad of websites they visit on a daily basis. And who can blame them – a 2008 study estimated it would take 244 hours each year to read every privacy policy in full for all the websites an average web browser visited annually. So put down your summer beach novel and start reading privacy policies – you’re already 10 weeks behind.

All kidding aside, this is a real problem for the United States’ federal data privacy legal framework, which is guided in part upon the Federal Trade Commission’s Fair Information Practice Principles. Notably, those include (i) consumer notice and awareness (“Consumers should be given notice of an entity’s information practices before any personal information is collected from them”), and (ii) consumer choice and consent (“In order to be effective, any choice regime should provide a simple and easily-accessible way for consumers to exercise their choice”). If the vast majority of websites utilize privacy policies which consumers are willfully ignoring or otherwise failing to recognize the existence of, much less comprehending their contents, how can one reasonably claim consumers are “on notice and aware” of privacy policies and exercising real “choice and consent” to the management of their personal data? Continue Reading You Read the Privacy Policy, Right? Sure You Did. A New Federal Bill Seeks to Address the Transparency Gap.

What is Privacy Shield?  Since 2016, U.S. companies and organizations receiving personal data relating to individuals in the European Union have relied upon a self-certification program known as Privacy Shield. Rather than enter into numerous agreements and meet other requirements to process the personal data of individuals in the EU, U.S. companies have been able to self-certify to a level of compliance to meet EU law. Privacy Shield serves to address the General Data Protection Regulation’s (GDPR) requirement that adequate safeguards be in place for the protection of transatlantic transfers of personal data and the receiving entity’s handling of that data. Under Privacy Shield, self-certified companies that comply with the agreement’s requirements are considered to have met the EU’s higher standard for data privacy and obtained some level of “adequacy.” Since its implementation, more than 5,300 companies have operated under its terms. The future of Privacy Shield, however, is now in jeopardy.

EU Court holds Privacy Shield to be Inadequate.  On July 16, 2020, Europe’s highest court, the Court of Justice of the European Union (CJEU) held that United States law is inadequate to protect EU citizens’ personal data to the extent that EU law requires. Specifically, the CJEU held that the “limitations on the protection of personal data arising from the domestic law of the United States, on the access and use by U.S. public authorities of such data transferred from the European Union… are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required under EU law.” To put it another way, Privacy Shield’s fundamental flaw, according to the court, is not so much that member companies’ practices are inadequate, but rather that the U.S. government cannot be trusted to maintain the confidentiality, integrity, and availability of personal data.  Specifically, the justices found that federal laws such as the Foreign Intelligence Surveillance Act “cannot be regarded as limited to what is strictly necessary” and fails to meet “minimum safeguards” guaranteed by the EU. Continue Reading Warning! Shields are Down: Top EU Court Invalidates EU-US Privacy Shield Protections

It is summer and you just finished all the hard work to make sure your organization addressed all applicable California Consumer Privacy Act (CCPA or the “Act”) requirements.  You sit down, take a deep breath, and see what California has been up to during your CCPA preparations.  Well, lo and behold, California wants to give the nation’s most aggressive data protection law a facelift in a new ballot initiative to be voted on this November.

You may remember that California pioneered the first sweeping privacy reform in the United States in 2018 when the CCPA was passed. The Act was amended in 2019 and went into effect January 1, 2020, with enforcement beginning July 1 of this year. Taft’s Privacy & Data Security group has provided information regarding the data requirements of the CCPA in previous blog posts, but generally, the Act affords consumers the right to know what information is being collected from them, the right to prohibit businesses from keeping their information, and the right to opt-out of the sale of their personal information, among other things.  The CCPA already reaches outside California state lines, as it applies to companies that do business within the state that have revenues of over $25 million per year, derive at least 50% of its revenue from selling information, or buy, sell or share personal information of at least 50,000 California consumers, households or devices.

Continue Reading Data Déjà vu? Data Protection Back On the Ballot in California

Just a friendly reminder from the Taft Law Privacy and Data Security Practice Group that the Attorney General of California will commence enforcement of the California Consumer Privacy Act (CCPA) on July 1, 2020. While we have all understandably been focused on the many important issues of this year, both personally and professionally, let us not forget that the Attorney General of California explicitly declined to extend the enforcement date due to COVID-19 for this first of its kind state privacy law.

While it is obviously late in the game, and impossible to provide you all the ins and outs of CCPA compliance in this single post, you can always check older posts on our Taft Privacy & Data Security Insights.  That said, it doesn’t mean you can’t get started or continue making progress to understand and meet any applicable requirements for your business. Here are some quick points and additional resources to consider. Continue Reading Don’t Forget! CCPA Enforcement Commences July 1, 2020