California AG Seeks Comment on Revised Draft CCPA Rules
Attorney General Xavier Becerra (D) released revised draft rules to implement the California Consumer Privacy Act, based on suggestions in about 200 received comments. The AG office wants comments on revisions by Feb. 24, it said in a Friday notice.…
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
The AG expects to start enforcing the law July 1, though some are seeking delay (see 2001290040). The AG added guidance on what is personal information, saying it “depends on whether the business maintains information in a manner that ‘identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household.’ For example, if a business collects the IP addresses of visitors to its website but does not link the IP address to any particular consumer or household, and could not reasonably link the IP address with a particular consumer or household, then the IP address would not be ‘personal information.’” Service providers “shall not retain, use, or disclose personal information obtained in the course of providing services except” to perform services specified in the written contract with the business providing it, to retain and employ a subcontractor, for internal use to build or improve services and to detect data security incidents or combat fraudulent or illegal activity, the revised draft says. Another addition says a business may not require a consumer to pay a fee to verify requests for or to delete information. “For example, a business may not require a consumer to provide a notarized affidavit to verify their identity unless the business compensates the consumer for the cost of notarization.” A business may deny a request for specific personal information if it can’t verify the identity of the requestor, said another addition. “If the business has no reasonable method by which it can verify any consumer, the business shall explain why it has no reasonable verification method in its privacy policy.” Notices should be “reasonably” accessible to people with disabilities, said another clarification. The AG also adjusted definitions of some terms including household and added examples illustrating certain rules. "If there are no further changes, the Attorney General will finalize the text of the regulations and other documents in the rulemaking file," a Becerra spokesperson emailed. "The Office of Administrative Law will have 30 business days to review the regulations, and if OAL approves, the rules will go into effect."