United States

California Privacy Rights Act (CPRA)

The California Privacy Rights Act (CPRA), also known as Proposition 24, is a ballot measure that was approved by California voters on Nov. 3, 2020. It amends and expands the CCPA, and also referred to as “CCPA 2.0.”

In enacting this Act, it is the purpose and intent of the people of the State of California to further protect consumers’ rights, including the constitutional right of privacy. This Act came effective from December 16, 2020, but exemption has been given until January 1, 2023.

CPRA Applicability: [Section 1798.140(d)]

CPRA will be applicable on the businesses who meets any of the following conditions:

As of January 1, of the calendar year, had

  1. Annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year or
  2. Alone or in combination, annually buys or sells or shares the personal information of 1,00,000 or more consumers or households or
  3. Derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal Information.
Personal Information [Section 1798.140(v)]

Personal information is defined broadly as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. It does not include publicly available information or deidentified or aggregate consumer information.

Data Subject Rights [Section 1798.105 – 1798.125]

Section 1798.105 – 1798.125 lists the 9 (nine) rights of Data Subject.

  1. Right to delete personal information.
  2. Right to correct inaccurate personal information.
  3. Right to know what personal information is collected.
  4. Right to Access personal information.
  5. Right to Know if Personal Information is Sold.
  6. Right to Opt-Out of sale or sharing of personal information.
  7. Right to Limit Use and Disclosure of Sensitive Personal Information.
  8. Right against discrimination.
  9. Right of data portability.

Organizations are expected to fulfil the consumer request no later than 45 calendar days of identifiable Data Subject request.

Click here to know more about CPRA.