Consumer data privacy protections received a boost at the recent US general election, with voters passing a ballot measure that amends and expands the California Consumer Privacy Act of 2018.
Proposition 24 passed by more than 1.7 million votes, or around 56 – 44 per cent so far, with 87 per cent of votes counted.
The result means the CCPA, already regarded as America’s strongest consumer data protections, will be expanded and strengthened, including a new enforcement agency. Because the law impacts Californian businesses, including many of the tech giants, it could usher in a new standard of data regulation in the US.
While the CCPA came into effect earlier this year, the changes resulting from Proposition 24 – known as the California Privacy Rights Act – won’t take effect until 2023.
Advocates say the ballot measure should also protect the legislation from further attempts by business interests to water down the existing laws while answering some of the concerns small businesses have with compliance.
The CCPA already effectively allows consumers to opt out of data trading and imposes specific restrictions on how businesses collect and process personal information.
The changes brought by Proposition 24 and the California Privacy Rights Act of 2020 include the establishment of a new category of “sensitive personal information” which includes an individual’s precise location, race, religion, sexual orientation, and specified health information, among others.
Under the amendment, individuals will have greater control over sensitive personal information, including a right to opt out of a business collecting and using it.
The threshold for who is subject to the laws has also been lifted to ease compliance pressures on smaller businesses. Businesses reaching more than 100,000 consumers is now the cut off, up from the CCPA’s original 50,000. There are still other jurisdictional requirements, including revenue above US$25 million per year, or a business that receives more than half of its income from the sale of personal information of CA consumers.
A new enforcement agency, the California Privacy Protection Agency, will also be established to monitor and enforce consumer privacy laws in California, including an ability to issue fines for breaches.
Penalties for violations involving minors will also increase significantly under the changes.