Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

New York

Washington, D.C.

core/separator

core/heading

core/list

As we discussed in previous Privacy &amp; Cybersecurity Updates (<a href="https://www.thompsonhine.com/publications/california-expands-consumer-privacy-protections" target="_blank" rel="noopener">“California Expands Consumer Privacy Protections”</a> and <a href="https://www.thompsonhine.com/publications/amendments-to-california-privacy-law-will-impact-businesses" target="_blank" rel="noopener">“Amendments to California Privacy Law Will Impact Businesses”</a>), the California Consumer Protection Act (CCPA) is an expansive, rights-based approach to privacy with national and international ramifications that will likely serve as a template for other states as they draft their own consumer privacy and data protection legislation. The time for compliance is now, as the CCPA takes effect on January 1, 2020, and it includes a “look back” period, which makes it critical for businesses to evaluate their data practices in the months leading up to its effective date.

contentpilot/introduction

Given how quickly the CCPA originally was drafted, even the bill’s sponsors knew that amendments would be necessary before its effective date. On September 13, the very last day available on the legislative calendar, the California State Assembly passed a package of amendments clarifying the law’s application, as well as certain compliance obligations businesses now face under the CCPA. California Governor Gavin Newsom now has until October 13 to act on the amendments.

core/paragraph

The amendments passed by the California legislature on September 13 include:

However, this exemption on general business-related information does not apply to the CCPA’s provision granting individuals the right to opt out of the sale of their data or its anti-discrimination provisions.&nbsp; The non-applicability of the “opt-out” rights clause in Assembly Bill 1355 is especially important in the context of businesses that share vendor and supplier information with affiliates or subsidiaries, which may implicate the “do not sell” rights within the meaning of the CCPA.&nbsp; The exemptions set forth in Assembly Bill 1355 have a one-year sunset clause and will become inoperative on January 1, 2021.

The CCPA is a comprehensive U.S. data privacy law, and entities doing business in California need to ensure they comply or they risk severe penalties. Businesses should not wait to implement their compliance policies, as the CCPA goes into effect on January 1, 2020. While the California Attorney General’s enforcement is not expected until at least July 1, 2020, consumer lawsuits, including class actions, could start in early 2020. It is important to remember that the CCPA can apply to even businesses that do not have offices and employees in California, and that it can apply to activities conducted outside of California.

Companies that evaluate their internal data regulation and privacy policies and take proactive steps to update them will aid in their organization’s timely compliance with the CCPA, while also minimizing business risks. The keys to being ready for the CCPA are to identify the data being collected and retained; have established notices, processes and procedures to comply with the CCPA’s substantive and procedural requirements; and have mechanisms and processes to respond to data requests, which should be included in the company’s website privacy statements.

Our team will continue to monitor developments in the California legislature and Attorney General’s office and provide further updates.

Thomas F. Zych 216.566.5605 <a href="mailto:Tom.Zych@ThompsonHine.com">Tom.Zych@ThompsonHine.com</a>

Steven G. Stransky 216.566.5646 202.263.4126 <a href="mailto:Steve.Stransky@ThompsonHine.com">Steve.Stransky@ThompsonHine.com</a>

Mona Adabi 202.263.4147 <a href="mailto:Mona.Adabi@ThompsonHine.com">Mona.Adabi@ThompsonHine.com</a>

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2022/04/Privacy__Cybersecurity_Update_-_Californias_New_Privacy_Law_-_Recent_Amendments_and_Approaching_Compliance_Deadlines.pdf

California’s New Privacy Law: Recent Amendments and Approaching Compliance Deadlines

Services