The California Attorney General and the Department of Justice held the first public forum about the California Consumer Privacy Act (CCPA) on Tuesday, Jan. 8, in San Francisco. The public forums are part of the rulemaking process the attorney general's office is undertaking pursuant to Section 1798.185 of the CCPA, which requires the attorney general to "solicit broad public participation and adopt regulations to further the purposes" of the CCPA. These forums are an opportunity to provide input to the attorney general prior to publication of the proposed rules, and BakerHostetler will be actively participating throughout the public comment and subsequent rulemaking process.
To read more about the issues that still need clarification under the amended CCPA, some of which were discussed at the forum, please see our blog post here.
BakerHostetler attended the first of the six public forums alongside a packed room of lawyers, trade associations and privacy advocacy groups. Although scheduled to last three hours, the forum ended shortly after the first hour, to the chagrin of those in attendance.
While the first hour of public comments covered a variety of issues, the main takeaways stemmed around the need for clarity in the following areas:
- The application or nonapplication of the CCPA to employment and HR data, as legislative history suggests the intended focus was on the consumer and not employees.
- The extent to which a cure can remediate security issues prospectively or retrospectively.
- The covered entity threshold for 50,000 consumers, devices and households, and the respective definitions of each.
- What constitutes the "sale" of a consumer's personal information. The CCPA currently defines "sale" as any dissemination of a consumer's personal information "to another business or third party for monetary or other valuable consideration."
Additional guidance, outside the mandatory rulemaking required under Section 1798.185, is unlikely as the deadline for the guidelines gets closer and the attorney general's office remains understaffed and overwhelmed by the breadth of unfamiliar subject matter.
Additional public forums will take place on Jan. 14 in San Diego, Jan. 24 in Riverside, Jan. 25 in Los Angeles, Feb. 5 in Sacramento and Feb. 13 in Fresno; more details can be found here. BakerHostetler will be attending the San Diego and Los Angeles forums as well, and will provide further updates as the public forums proceed.
A summary of the CCPA is available here, and a comparison to GDPR is available here. Information on BakerHostetler's CCPA compliance services are available here, or feel free to contact the authors.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.