View Entry Pdf.pdf

The California Privacy Protection Agency (CPPA) has begun its rulemaking process for the California Privacy Rights Act (CPRA), seeking public comments on various topics, including opt-out rights, intentional interaction standards, risk assessments, automated decisionmaking, and service provider restrictions on combining data. The CPPA is interested in comments on new and undecided issues not already covered by the existing California Consumer Privacy Act (CCPA) regulations. Key topics under consideration include:

Opt-out rights, including limiting use of sensitive personal information and enabling consumers to consent to uses of their personal information after opting out
Intentional interaction standard, including refining the definition of "intentionally interacts"
Risk assessments, including defining "significant risk" and requirements for regular cybersecurity audits and privacy risk assessments
Automated decisionmaking, including defining "automated decisionmaking" and types of disclosures to consumers
* Service provider restrictions on combining data from multiple customers, including defining "business purposes" for combining personal information

The CPPA is also addressing technical issues, such as the right to correct inaccurate personal information, lookback, audit authority, and definitions of key terms. Comments are due by November 8, 2021.