Jump to content

California Privacy Rights Act: Difference between revisions

Add links
From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
Undid revision 1236698971 by Lillianbroschart (talk)
No edit summary
Line 28: Line 28:
{{ElectionsCA}}
{{ElectionsCA}}


The '''California Privacy Rights Act of 2020''' ('''CPRA'''), also known as '''Proposition 24''', is a [[California ballot proposition]] that was approved by a majority of voters after appearing on the ballot for [[2020 California elections|the general election]] on November 3, 2020.<ref name=":2">{{cite news |last=Dustin |first=Gardiner |title=California's Proposition 24 would protect data-privacy law from being weakened in Legislature |url=https://www.sfchronicle.com/politics/article/California-s-Proposition-24-would-protect-15582105.php |access-date=September 24, 2020 |work=San Francisco Chronicle |date=September 21, 2020}}</ref><ref name=":1">{{Cite web|title=Text of Proposed Laws - Proposition 24|url=https://vig.cdn.sos.ca.gov/2020/general/pdf/topl-prop24.pdf|website=California Secretary of State}}</ref><ref>{{Cite web|last=Hooks|first=Chris Nichols, Kris|title=What We Know About California Proposition Results|url=https://www.capradio.org/158690|access-date=2020-11-11|website=www.capradio.org}}</ref> This proposition expands California's consumer privacy law and builds upon the [[California Consumer Privacy Act]] (CCPA) of 2018, which established a foundation for consumer privacy regulations.<ref name=":0">{{Cite web|date=2018-10-15|title=California Consumer Privacy Act (CCPA)|url=https://oag.ca.gov/privacy/ccpa|access-date=2020-11-09|website=State of California - Department of Justice - Office of the Attorney General|language=en}}</ref>
The '''California Privacy Rights Act of 2020''' ('''CPRA'''), also known as '''Proposition 24''', is a [[California ballot proposition]] that was approved by a majority of voters after appearing on the ballot for [[2020 California elections|the general election]] on November 3, 2020.<ref>{{cite news |last=Dustin |first=Gardiner |title=California's Proposition 24 would protect data-privacy law from being weakened in Legislature |url=https://www.sfchronicle.com/politics/article/California-s-Proposition-24-would-protect-15582105.php |access-date=September 24, 2020 |work=San Francisco Chronicle |date=September 21, 2020}}</ref><ref name=":1">{{Cite web|title=Text of Proposed Laws - Proposition 24|url=https://vig.cdn.sos.ca.gov/2020/general/pdf/topl-prop24.pdf|website=California Secretary of State}}</ref><ref>{{Cite web|last=Hooks|first=Chris Nichols, Kris|title=What We Know About California Proposition Results|url=https://www.capradio.org/158690|access-date=2020-11-11|website=www.capradio.org}}</ref> This proposition expands California's consumer privacy law and builds upon the [[California Consumer Privacy Act]] (CCPA) of 2018, which established a foundation for consumer privacy regulations.<ref name=":0">{{Cite web|date=2018-10-15|title=California Consumer Privacy Act (CCPA)|url=https://oag.ca.gov/privacy/ccpa|access-date=2020-11-09|website=State of California - Department of Justice - Office of the Attorney General|language=en}}</ref>


The proposition enshrines more provisions in [[California state law]], allowing consumers to prevent businesses from sharing their [[personal data]], correct inaccurate personal data, and limit businesses' usage of "sensitive personal information", which includes precise geolocation, race, ethnicity, religion, genetic data, private communications, sexual orientation, and specified health information. The Act creates the [[California Privacy Protection Agency]] as a dedicated agency to implement and enforce state privacy laws, investigate violations, and assess penalties of violators.<ref>{{Cite web|title=California Proposition 24: New rules for consumer data privacy|url=https://calmatters.org/election-2020-guide/proposition-24-data-privacy/|access-date=2020-11-09|website=CalMatters|date=9 September 2020 |language=en-US}}</ref> Under the CCPA the provisions applied to businesses buying, selling, or sharing personal information of 50,000 or more consumers, the CPRA expanded this scope by raising the threshold to 100,000 or more consumers. In addition to the consumer protections, The Act also removes the set time period in which businesses can correct violations without penalty, prohibits businesses from holding onto personal data for longer than necessary, triples the maximum fines for violations involving children under the age of 16 (up to $7,500), and authorizes civil penalties for the theft of specified login information.<ref>{{cite web |url=https://ballotpedia.org/California_Proposition_24,_Consumer_Personal_Information_Law_and_Agency_Initiative_(2020) |work=Ballotpedia |title=California Proposition 24, Consumer Personal Information Law and Agency Initiative (2020) |access-date=September 24, 2020}}</ref><ref>{{Cite web|title=Proposition 24 Official Title and Summary {{!}} Official Voter Information Guide {{!}} California Secretary of State|url=https://voterguide.sos.ca.gov/propositions/24/title-summary.htm|access-date=2020-12-10|website=voterguide.sos.ca.gov}}</ref>
The proposition enshrines more provisions in [[California state law]], allowing consumers to prevent businesses from sharing their [[personal data]], correct inaccurate personal data, and limit businesses' usage of "sensitive personal information", which includes precise geolocation, race, ethnicity, religion, genetic data, private communications, sexual orientation, and specified health information. The Act creates the [[California Privacy Protection Agency]] as a dedicated agency to implement and enforce state privacy laws, investigate violations, and assess penalties of violators.<ref>{{Cite web|title=California Proposition 24: New rules for consumer data privacy|url=https://calmatters.org/election-2020-guide/proposition-24-data-privacy/|access-date=2020-11-09|website=CalMatters|date=9 September 2020 |language=en-US}}</ref> The Act also removes the set time period in which businesses can correct violations without penalty, prohibits businesses from holding onto personal data for longer than necessary, triples the maximum fines for violations involving children under the age of 16 (up to $7,500), and authorizes civil penalties for the theft of specified login information.<ref>{{cite web |url=https://ballotpedia.org/California_Proposition_24,_Consumer_Personal_Information_Law_and_Agency_Initiative_(2020) |work=Ballotpedia |title=California Proposition 24, Consumer Personal Information Law and Agency Initiative (2020) |access-date=September 24, 2020}}</ref><ref>{{Cite web|title=Proposition 24 Official Title and Summary {{!}} Official Voter Information Guide {{!}} California Secretary of State|url=https://voterguide.sos.ca.gov/propositions/24/title-summary.htm|access-date=2020-12-10|website=voterguide.sos.ca.gov}}</ref>


The California Privacy Rights Act took effect on January 1, 2023, applying to personal data collected on or after January 1, 2022.<ref>{{Cite web|title=Move Over, CCPA: The California Privacy Rights Act Gets the Spotlight Now|url=https://news.bloomberglaw.com/privacy-and-data-security/move-over-ccpa-the-california-privacy-rights-act-gets-the-spotlight-now|access-date=2020-12-10|website=news.bloomberglaw.com|language=en}}</ref> The law cannot be repealed by the state legislature, and any amendments made by the legislature must be “consistent with and further the purpose and intent” of the Act.<ref>{{Cite web|title=The California Privacy Rights Act (CPRA) Has Been Enacted into Law|url=https://www.paulhastings.com/about-us/advice-for-businesses-in-dealing-with-the-expanding-coronavirus-events/coronavirus-blog/ph-privacy/2020/11/06/the-california-privacy-rights-act-(cpra)-has-been-enacted-into-law|access-date=2020-12-10|website=www.paulhastings.com}}</ref>
The California Privacy Rights Act took effect on January 1, 2023, applying to personal data collected on or after January 1, 2022.<ref>{{Cite web|title=Move Over, CCPA: The California Privacy Rights Act Gets the Spotlight Now|url=https://news.bloomberglaw.com/privacy-and-data-security/move-over-ccpa-the-california-privacy-rights-act-gets-the-spotlight-now|access-date=2020-12-10|website=news.bloomberglaw.com|language=en}}</ref> The law cannot be repealed by the state legislature, and any amendments made by the legislature must be “consistent with and further the purpose and intent” of the Act.<ref>{{Cite web|title=The California Privacy Rights Act (CPRA) Has Been Enacted into Law|url=https://www.paulhastings.com/about-us/advice-for-businesses-in-dealing-with-the-expanding-coronavirus-events/coronavirus-blog/ph-privacy/2020/11/06/the-california-privacy-rights-act-(cpra)-has-been-enacted-into-law|access-date=2020-12-10|website=www.paulhastings.com}}</ref>


== Background ==
== Background ==
The initiative represents an expansion of provisions first laid out by the [[California Consumer Privacy Act]]. In addition to the consumer protections, the proposition creates the California Privacy Protection Agency.<ref name=":0" /> The agency will share consumer privacy oversight and enforcement duties with the [[California Department of Justice]].<ref name=":0" /> Another effect of the initiative is requiring businesses to obtain permission from consumers younger than 16 before collecting their data and permission from a parent or guardian before collecting data from consumers younger than 13.<ref name="CASOS">{{cite web | url=http://www.sos.ca.gov/elections/ballot-measures/qualified-ballot-measures/ |title=Qualified Statewide Ballot Measures |publisher=[[Secretary of State of California]] |access-date=July 2, 2020}}</ref>
As technology has become more integrated into daily life lawmakers around the world have pushed for greater regulation of data privacy. Beginning in 1950, the European Convention on Human Rights asserted that data privacy should be subject to legal protections.<ref name=":3">{{Cite journal |last=Lisowski |first=Jena |date=March 1, 2024 |title=California Data Privacy Law and Automated Decision-making |journal=The Journal of Corporation Law |volume=49 |issue=3 |pages=701-26 |via=EBSCOhost}}</ref> Several episodes of unknown use and sale of consumer data, such as the Cambridge Analytica scandal, have led to US lawmakers pursuing better data privacy protections particularly those at the state-level. <ref name=":4">{{Cite journal |last=Rothstein |first=Mark A. |last2=Tovino |first2=Stacey A. |date=2019-09 |title=California Takes the Lead on Data Privacy Law |url=https://onlinelibrary.wiley.com/doi/10.1002/hast.1042 |journal=Hastings Center Report |language=en |volume=49 |issue=5 |pages=4–5 |doi=10.1002/hast.1042 |issn=0093-0334}}</ref> Additionally, the EU’s passage of the General Data Protection Regulation (GDPR) in 2018 spurred greater interest in adopting a similar measure in the US.<ref name=":3" /> The GDPR is the strictest data privacy law in the world, with few exceptions and hefty fines. The push to transition away from a laissez-faire approach to internet regulation in the US comes amidst related discussion on regulating other cutting edge technology such as AI. In California, these concerns manifested as the California Consumer Protection Act somewhat modeled on the EU’s GDPR.<ref name=":3" />


== Intentions of the Act ==
The CPPA’s initial drafting and placement on the 2018 ballot was led by Alastair Mactaggart.<ref name=":4" /> He later came to an agreement with Californian lawmakers to pass a scaled back version of the CCPA which was ultimately signed into law by Governor Brown. Although passed in 2018, the CCPA would not come into effect until January 1, 2020.<ref name=":3" /> Due to the CCPA’s scaled back nature amendments to further its scope were likely. In 2020 Proposition 24 or the CPRA appeared on the California ballot. The CPRA was designed to amend the CCPA to expand consumer data privacy <ref name=":2" />. Most notably, the CPRA altered the criteria that subjects a business to its rules and established the California Privacy Protection Agency to take the lead on enforcement of the CCPA <ref name=":3" />. The CPRA was passed with 56.2% of California voters in favor of the proposition and went into effect on January 1, 2023.<ref>{{Cite web |date=December 11, 2020 |title=Complete Statement of Vote, November 3, 2020 |url=https://elections.cdn.sos.ca.gov/sov/2020-general/sov/complete-sov.pdf |access-date=July 22, 2024 |website=California Secretary of State |language=en}}</ref>
⚫
The intentions of the Act are to provide California residents with the right to:

The CPRA represents an expansion of provisions first laid out by the [[California Consumer Privacy Act]]. Key changes include requiring businesses to obtain permission from consumers younger than 16 before collecting their data and permission from a parent or guardian before collecting data from consumers younger than 13.<ref name=":1" /> The CPRA also altered the CCPA to apply to businesses buying, selling, or sharing personal information of 100,000 or more consumers compared to the previous 50,000 or more.<ref name=":1" /> In addition to the consumer protections, the proposition creates the California Privacy Protection Agency.<ref name=":2" /> The agency initially shared consumer privacy oversight and enforcement duties with the [[California Department of Justice]]. As of April 21, 2022 the agency has taken over full responsibility of rulemaking and enforcement of the CCPA.<ref name=":3" />

== Purpose and Intentions ==
⚫
The purpose of the Act are to provide California residents with the right to:


# Know who is collecting their and their children's personal information, how it is being used, and to whom it is disclosed.
# Know who is collecting their and their children's personal information, how it is being used, and to whom it is disclosed.
Line 50: Line 46:
# Exercise their privacy rights without being penalized.
# Exercise their privacy rights without being penalized.
# Hold businesses accountable for failing to take reasonable [[information security]] precautions.
# Hold businesses accountable for failing to take reasonable [[information security]] precautions.
# Benefit from businesses' use of their personal information.
# Have their privacy interests protected even as employees and independent contractors.<ref name=":1" />

== Polls ==
{| class="wikitable" style="font-size:90%;text-align:center;"
|- valign=bottom
! Poll source
! Date(s)<br>administered
! Sample<br>size{{efn|name=key|Key:<br>A – all adults<br>RV – registered voters<br>LV – likely voters<br>V – unclear}}
! Margin<br>of error
! style="width:100px;"| For Proposition 24
! style="width:100px;"| Against Proposition 24
! Undecided
|-
| style="text-align:left;"|[https://curated.tncontentexchange.com/states/california/prop-24-the-california-privacy-rights-act-receives-support-from-77-of-likely-california-voters/article_e50364e5-79a7-5746-8229-c2067305b95f.html Goodwin Simon Strategic Research/YES on Prop 24]{{efn-ua|name=yeson24}}
| September 29 – October 5, 2020
| 750 (LV)
| –
|style="background: rgb(1,223,116);"|'''77%'''
|11%
|12%
|-
| style="text-align:left;"|[https://redfieldandwiltonstrategies.com/california-presidential-proposition-22-and-proposition-24-voting-intentions-19-21-september/ Redfield & Wilton Strategies]
|September 19–21, 2020
|1,915 (LV)
| –
|style="background: rgb(1,223,116);"|'''60%'''
|17%
|23%
|-
| style="text-align:left;"|[https://curated.tncontentexchange.com/states/california/prop-24-the-california-privacy-rights-act-receives-support-from-77-of-likely-california-voters/article_e50364e5-79a7-5746-8229-c2067305b95f.html Goodwin Simon Strategic Research/YES on Prop 24]{{efn-ua|name=yeson24|Poll sponsored by a campaign which supported Proposition 24 prior to this poll's sampling period}}
| July 26–31, 2020
| – (V){{efn|Not yet released}}
| –
|style="background: rgb(1,223,116);"|'''81%'''
|11%
|8%
|}

== Results ==
The proposition passed with roughly 55% of California voters voting in favor of the measure.<ref>{{Cite web|last=Morrison|first=Sara|date=2020-11-03|title=Live results for California's data privacy ballot initiative|url=https://www.vox.com/policy-and-politics/2020/11/3/21546835/california-proposition-24-live-results-data-privacy|access-date=2020-11-08|website=Vox|language=en}}</ref>

== Notes ==
{{notelist}}
{{notelist}}
;Partisan clients
;
{{notelist-ua}}
{{notelist-ua}}


Revision as of 06:08, 26 July 2024

This article is about a privacy and data protection law in California. For the other California law also abbreviated CPRA, see California Public Records Act.
Proposition 24
November 3, 2020 (2020-11-03)
Privacy Rights and Enforcement Act Initiative
Results
Choice
 Votes %
Yes 9,384,125 56.23%
No 7,305,026 43.77%
Elections in California
Federal government
U.S. President
U.S. Senate
U.S. House of Representatives
State government
Executive
Governor
Lieutenant governor
Attorney general
Secretary of state
Treasurer
Controller
Insurance commissioner
Superintendent
Board of equalization
Legislature
Senate
Assembly
Judiciary
Court of appeals
Elections by year
State propositions
1910–1919
1960–1969
1970–1979
1980–1989
1990–1999
2000–2009
2010–2019
2020–2029
Full list
Los Angeles County
Los Angeles County
Board of supervisors
Ballot measures
  • 1980
  • 2008
  • 2012
  • 2016
Elections
Los Angeles
Mayor
City attorney
Ballot measures
  • 1986
  • 2017
Elections
Long Beach
Mayor
Orange County
Orange County
Board of supervisors
District attorney
Anaheim
Mayor
Irvine
Mayor
Costa Mesa
Municipal
Sacramento
Mayor
San Diego County
San Diego County
Board of supervisors
San Diego
Mayor
City attorney
City council
San Francisco
Mayor
District attorney
Board of supervisors
Board of education
Ballot measures
  • 2024
Elections
San Jose
Mayor
Other localities
Bakersfield

Mayoral elections:

Fresno

Mayoral elections:

Oakland

Mayoral elections:

Riverside

Mayoral elections:

San Bernardino

Mayoral elections:

Stockton

Mayoral elections:

The California Privacy Rights Act of 2020 (CPRA), also known as Proposition 24, is a California ballot proposition that was approved by a majority of voters after appearing on the ballot for the general election on November 3, 2020.[1][2][3] This proposition expands California's consumer privacy law and builds upon the California Consumer Privacy Act (CCPA) of 2018, which established a foundation for consumer privacy regulations.[4]

The proposition enshrines more provisions in California state law, allowing consumers to prevent businesses from sharing their personal data, correct inaccurate personal data, and limit businesses' usage of "sensitive personal information", which includes precise geolocation, race, ethnicity, religion, genetic data, private communications, sexual orientation, and specified health information. The Act creates the California Privacy Protection Agency as a dedicated agency to implement and enforce state privacy laws, investigate violations, and assess penalties of violators.[5] The Act also removes the set time period in which businesses can correct violations without penalty, prohibits businesses from holding onto personal data for longer than necessary, triples the maximum fines for violations involving children under the age of 16 (up to $7,500), and authorizes civil penalties for the theft of specified login information.[6][7]

The California Privacy Rights Act took effect on January 1, 2023, applying to personal data collected on or after January 1, 2022.[8] The law cannot be repealed by the state legislature, and any amendments made by the legislature must be “consistent with and further the purpose and intent” of the Act.[9]

Background

The initiative represents an expansion of provisions first laid out by the California Consumer Privacy Act. In addition to the consumer protections, the proposition creates the California Privacy Protection Agency.[4] The agency will share consumer privacy oversight and enforcement duties with the California Department of Justice.[4] Another effect of the initiative is requiring businesses to obtain permission from consumers younger than 16 before collecting their data and permission from a parent or guardian before collecting data from consumers younger than 13.[10]

Intentions of the Act

The intentions of the Act are to provide California residents with the right to:

  1. Know who is collecting their and their children's personal information, how it is being used, and to whom it is disclosed.
  2. Control the use of their personal information, including limiting the use of their sensitive personal information.
  3. Have access to their personal information and the ability to correct, delete, and transfer their personal information.
  4. Exercise their privacy rights through easily accessible self-serve tools.
  5. Exercise their privacy rights without being penalized.
  6. Hold businesses accountable for failing to take reasonable information security precautions.
  7. Benefit from businesses' use of their personal information.
  8. Have their privacy interests protected even as employees and independent contractors.[2]

Polls

Poll source Date(s)
administered 		Sample
size[a] 		Margin
of error 		For Proposition 24 Against Proposition 24 Undecided
Goodwin Simon Strategic Research/YES on Prop 24[A] September 29 – October 5, 2020 750 (LV) – 77% 11% 12%
Redfield & Wilton Strategies September 19–21, 2020 1,915 (LV) – 60% 17% 23%
Goodwin Simon Strategic Research/YES on Prop 24[A] July 26–31, 2020 – (V)[b] – 81% 11% 8%

Results

The proposition passed with roughly 55% of California voters voting in favor of the measure.[11]

Notes

  1. ^ Key:
    A – all adults
    RV – registered voters
    LV – likely voters
    V – unclear
  2. ^ Not yet released
Partisan clients
  1. ^ a b Poll sponsored by a campaign which supported Proposition 24 prior to this poll's sampling period

References

  1. ^ Dustin, Gardiner (September 21, 2020). "California's Proposition 24 would protect data-privacy law from being weakened in Legislature". San Francisco Chronicle. Retrieved September 24, 2020.
  2. ^ a b "Text of Proposed Laws - Proposition 24" (PDF). California Secretary of State.
  3. ^ Hooks, Chris Nichols, Kris. "What We Know About California Proposition Results". www.capradio.org. Retrieved 2020-11-11.{{cite web}}: CS1 maint: multiple names: authors list (link)
  4. ^ a b c "California Consumer Privacy Act (CCPA)". State of California - Department of Justice - Office of the Attorney General. 2018-10-15. Retrieved 2020-11-09.
  5. ^ "California Proposition 24: New rules for consumer data privacy". CalMatters. 9 September 2020. Retrieved 2020-11-09.
  6. ^ "California Proposition 24, Consumer Personal Information Law and Agency Initiative (2020)". Ballotpedia. Retrieved September 24, 2020.
  7. ^ "Proposition 24 Official Title and Summary | Official Voter Information Guide | California Secretary of State". voterguide.sos.ca.gov. Retrieved 2020-12-10.
  8. ^ "Move Over, CCPA: The California Privacy Rights Act Gets the Spotlight Now". news.bloomberglaw.com. Retrieved 2020-12-10.
  9. ^ "The California Privacy Rights Act (CPRA) Has Been Enacted into Law". www.paulhastings.com. Retrieved 2020-12-10.
  10. ^ "Qualified Statewide Ballot Measures". Secretary of State of California. Retrieved July 2, 2020.
  11. ^ Morrison, Sara (2020-11-03). "Live results for California's data privacy ballot initiative". Vox. Retrieved 2020-11-08.
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=California_Privacy_Rights_Act&oldid=1236720763"