Proposed Regulations Under the California Consumer Credit Privacy Act

By Linda C. Odom and John ReVeal

On October 10, 2019, the California Attorney General issued proposed regulations under the California Consumer Privacy Act (CCPA). The Attorney General will hold four public hearings, on December 2 through December 5, 2019, during which statements or comments may be presented, orally or in writing. Written comments in addition to those submitted at the public hearing also may be mailed or emailed to the Attorney General’s office until 5:00 p.m. on December 6, 2019.

The proposed regulations focus on the form and content of required notices and disclosures, practices for handling of consumer requests, practices for verifying the identity of the consumer making those requests, practices regarding the personal information of minors, and the offering of financial incentives as contemplated by the CCPA. 

The proposed regulations do not, however, address a number of interpretive issues in the CCPA with which businesses are struggling.  For example, the proposed regulations do not address whether the $25,000,000 annual gross revenue threshold that causes a company to be subject to the CCPA is based on worldwide or United States revenue or only California revenue (we believe it probably is not limited to California revenue, but that is not absolutely clear).  In addition, while the proposed regulations provide certain standards for verifying the identities of individuals who make requests for information or requests for the deletion of their personal information, they do not provide any guidance on the steps that a business can take to confirm that an individual is in fact a resident of California and thus entitled to the protections of the CCPA.  The proposed regulations also do not address the scope of certain exceptions from the CCPA, including the potentially very important exception for personal information that is collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act.

The day after the Attorney General announced these proposed regulations, California Governor Newsom signed five bills amending the CCPA.  These bills also do not address the issues outlined above, but provide certain regulatory relief and clarify certain other matters.  We will summarize these bills in a separate article.