In summary, the broad private right of action in the initiative covers instances of data breach – violations are subject to enforcement by the Attorney General – the right to know all a consumer’s personal information for free twice a year, the right to delete, and opt-in for consumers under 16 years old.
The legislation goes into effect in January 2020.
- Right to know all data collected by a business on you (twice annually free of charge).
- Right to say no to the sale of your information.
- Right to delete your data.
- Right to be informed of what categories of data will be collected about you prior to its collection, and to be informed of any changes to this collection.
- Mandated opt-in before sale of children’s information (under the age of 16).
- Right to know the categories of third parties with whom your data is shared.
- Right to know the categories of sources of information from whom your data was acquired.
- Right to know the business or commercial purpose of collecting your information.
- Enforcement by the Attorney General.
- Private right of action regarding data breaches only.
- Right to know what categories of information collected about you (once annually free of charge).
- Right to know where your data is sold or disclosed for business purposes, by category of your data.
- Right to say no to sale of information.
- Stricter regulations around pricing of services.
- Expanded private right of action covering all contents of initiative.
- Expanded AG enforcement covering all contents of the initiative.
The California Consumers Privacy Act is available at https://www.caprivacy.org/
For more information on how privacy to implement privacy policies in your business, contact Francesca Giannoni-Crystal.