Although the California Privacy Rights Act (CPRA) does not repeal the California Consumer Privacy Act (CCPA), it does change and augments it in several ways. The good news is, the CPRA doesn’t take effect until January 1, 2023, and the threshold has been raised to favor small-medium businesses, the time has been extended for employee and business-to-business information, and the CPRA still limits its private right of action for claims related to data breaches only. Employers are advised to: reassess the organization’s data sharing and marketing strategies in light of the CPRA’s changed definitions regarding data “sales” and “sharing;” inventory and rationalize “sensitive personal information” collected by the organization to meet new standards; prepare for additional and expanded data subject rights, and prepare to welcome new policymakers and enforcers.
