Is there new data privacy legislation coming our way?
On November 3, Californians have voted on and passed Proposition 24: The California Privacy Rights Act (CPRA) of 2020 which is pushing California further ahead in terms of data privacy legislation compared to the rest of the U.S.
This new legislation adds to Cali’s already effective data privacy law – the California Consumer Privacy Act (CCPA) and aims to close some of the loopholes.
The CPRA 2020 will –
- prevent organisations from sharing personal information
- limit the use of “sensitive personal information” incl. precise location, race, religion, social security information and any other info categorised as personal
- prohibit personal data retention for longer than required (or necessary)
- triple penalties for violations involving minors (under 16)
- create a new California Privacy Protection Agency which will replace the attorney general’s office as the enforcer
- expand the private right of action for consumers
- create new commitments for opt-out links
The new data privacy legislation will also slightly change who is considered a “covered business” and, consequently, who must comply. Under the CPRA 2020, to be a covered business, one of three requirements must be met –
1) the business acquires at least 50% of its annual revenue by sharing or selling the personal data of California-based consumers
2) the business’s gross revenue is over $25 million
3) buy, sell or share the personal data of more than 100,000 Californians (changed from 50,000 under the CCPA)
The CPRA 2020 will not come into effect until January 1, 2023. Until that time, the CCPA would remain in force.
Why should you care? Assuming this data privacy legislation comes into effect, businesses subject to CCPA – and all other email marketing laws – must ensure they have studied and understood all the new requirements. Regardless of where your business operates, if you are sending marketing emails to users around the globe, compliance with email marketing laws where the recipient resides is crucial.