Preparing for CPRA’s Expanded Consumer Rights

Comments for the California Privacy Protection Agency’s (CPPA) draft regulation to implement the California Privacy Rights Act (CPRA) are due August 23, 2022. The draft regulation published by the CPPA defines both expanded and new consumer rights and lays out how CPPA is likely to define the obligations of businesses. It expands the scope of the existing opt-out right to include the “sharing” of personal information with third parties and extends the 12-month window that consumers have to request information about how their personal information was collected. The draft also expands the right to delete, clarifying that a business must send requests to remove personal consumer information to all relevant parties. New rights granted to consumers include the right to correct any inaccurate personal information maintained by a business, and the right to limit the use and disclosure of sensitive personal information. One of the items on the CPRA to-do lists of many businesses is how to address these new and expanded rights as they prepare for the operational changes they may need to implement. Although it is unclear which amendments to the proposed rules will survive the review process, it is evident that implementing the expanded consumer rights requirements will, in all likelihood, require substantial time and resources.