The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are pivotal privacy laws that enhance consumer data protection in California. Understanding the distinctions between these two regulations is essential for businesses, including Shopify store owners, to ensure compliance and maintain consumer trust.
Overview of CCPA and CPRA
- CCPA: Enacted in 2018 and effective from January 1, 2020, the CCPA grants California consumers rights over their personal information, including the right to know, delete, and opt-out of the sale of their data.
- CPRA: Approved by voters in November 2020 and effective from January 1, 2023, the CPRA amends and expands the CCPA, introducing new consumer rights and establishing the California Privacy Protection Agency (CPPA) for enforcement.
Key Differences Between CCPA and CPRA
Expanded Consumer Rights
- Right to Correction: Under the CPRA, consumers can request businesses to correct inaccurate personal information.
- Right to Limit Use of Sensitive Personal Information: Consumers can restrict the use of sensitive personal information, such as race, health data, or precise geolocation, particularly concerning its use in advertising.
- Right to Access Information on Automated Decision-Making: The CPRA allows consumers to understand and opt-out of automated decision-making technologies used in profiling.
New Category: Sensitive Personal Information
The CPRA introduces “sensitive personal information” as a distinct category, encompassing data like social security numbers, financial information, and precise geolocation. Businesses are required to provide additional protections for this type of data.
Changes in Applicability Thresholds
The CPRA adjusts the criteria determining which businesses must comply:
- Data Processing Volume: The threshold for businesses that buy, sell, or share personal information increases from 50,000 to 100,000 consumers or households.
- Revenue from Data Sharing: The CPRA includes businesses that derive 50% or more of their annual revenues from sharing (not just selling) consumers’ personal information.
Establishment of the California Privacy Protection Agency (CPPA)
The CPRA creates the CPPA, a dedicated agency responsible for enforcing California’s privacy laws, conducting audits, and providing guidance to businesses and consumers.
Implications for Businesses
Businesses, including Shopify store owners, should take note of the following:
- Compliance Obligations: With the CPRA’s expanded scope, businesses may need to update their data processing practices, privacy policies, and consumer rights management procedures.
- Data Mapping and Inventory: Identifying and categorizing sensitive personal information is crucial to comply with the CPRA’s requirements.
- Consumer Rights Management: Implementing mechanisms to facilitate new consumer rights, such as correction and limiting the use of sensitive information, is essential.
By utilizing tools like the Pandectes, businesses can navigate the complexities of evolving privacy regulations and ensure they meet their legal obligations while fostering consumer trust.
