CCPA Seen Set to Become US' Default Privacy Protection Rules

privacy lawyer Becky Burr said Friday at the FCBA annual retreat. CCPA will apply to a broader and deeper data set than the EU's general data protection regulation, meaning "significant" reworking of systems needs to be done before it takes effect Jan. 1, she said. "There's a bit of a scramble going on." There's much industry consensus that federal pre-emption is needed to avoid a proliferation of competing state laws, she said in Hot Springs, Virginia. Among proposals in Congress, most agree on the need for a larger role for the FTC, but they disagree on other topics like private rights of action, she noted. Burr said federal legislation that pre-empts CCPA seems unlikely to come to pass, and meanwhile 30-plus states are kicking around their own form of privacy bills. While the California legislature also is looking at changes to CCPA, a risk is that a significant change could give rise to another ballot initiative like the one that prompted creation of the law in the first place, she said. She said the idea of eliminating the right to cure before fines kick in for violations is dead with state lawmakers, but other provisions moving through the legislature would clarify its non-applicability to employees and contractors, modify its definition of personal information and eliminate the requirement companies maintain a toll-free line for allowing consumer opt-outs.