The following is the full text of the California Consumer Privacy Act (CCPA) after it was amended by SB-1121. No notice shall be required prior to an individual consumer initiating an action solely for actual pecuniary damages suffered as a result of the alleged violations of this title. Common reasons why businesses may keep your personal information include: See Civil Code sections 1798.105(d) and 1798.145 for more exceptions. The business shall bear the burden of demonstrating that any verified consumer request is manifestly unfounded or excessive. Section 1798.121 - [Operative 1/1/2023] Consumers' Right to Limit Use and Disclosure of Sensitive Personal Information. Under law, it must be honored by covered businesses as a valid consumer request to stop the sale of personal information. (d) A judgment entered in accordance with this section has the same force and effect as, and is subject to all the provisions of law relating to, a judgment in a civil action and may be enforced in the same manner as any other judgment of the court in which it is entered. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. (b) Subdivisions (m) and (n) of Section 1798.145, Sections 1798.160, 1798.185, Sections 1798.199.10 through 1798.199.40, inclusive, and Section 1798.199.95 shall become operative on the effective date of the act. (A) Its online privacy policy or policies if the business has an online privacy policy or policies. SEC. SEC. Page 2 of 29 The disclosure shall cover the 12-month period preceding the business receipt of the verifiable consumer request and shall be made in writing and delivered through the consumers account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumers option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. California is currently on track to be the first state to provide expansive privacy rights to employees. (a) Upon the sworn complaint of any person or on its own initiative, the agency may investigate possible violations of this title relating to any business, service provider, contractor, or person. A link to it can usually be found at the bottom of the homepage and other webpages. Section 1798.100 of the Civil Code is amended to read: 1798.100. (f) This title shall not apply to personal information collected, processed, sold, or disclosed pursuant to the Drivers Privacy Protection Act of 1994 (18 U.S.C. Section 1: Title: The California Privacy Rights Act of 2020 Section 2: Findings and Declarations Section 3: Purpose and Intent (A) Consumer Rights (B) Responsibilities of Businesses (C) Implementation of the Law Section 4: General Duties of Businesses that Collect Personal Information Section 5: Consumers' Right to Delete Personal Information The categories of personal information that the business disclosed about the consumer for a business purpose. Exempted businesses include consumer reporting agencies (commonly known as credit bureaus) and certain financial institutions and insurance companies. Personal information is information that identifies, relates to, or could reasonably be linked with you or your household. For purposes of this subdivision, the definition of medical information in Section 56.05 shall apply and the definitions of protected health information and covered entity from the federal privacy rule shall apply. In response to the measures qualification, the Legislature enacted the California Consumer Privacy Act of 2018 (CCPA) into law. Device means any physical object that is capable of connecting to the internet, directly or indirectly, or to another device. (b) If this measure is approved by the voters but superseded by law by any other conflicting measure approved by voters at the same election, and the conflicting ballot measure is later held invalid, this measure shall be self-executing and given full force and effect. Processing means any operation or set of operations that are performed on personal data or on sets of personal data, whether or not by automated means. (d) Promote public awareness and understanding of the risks, rules, responsibilities, safeguards, and rights in relation to the collection, use, sale, and disclosure of personal information, including the rights of minors with respect to their own information, and provide a public report summarizing the risk assessments filed with the agency pursuant to paragraph (15) of subdivision (a) of Section 1798.185 while ensuring that data security is not compromised. (A) Has annual gross revenues in excess of twenty-five million dollars ($25,000,000), as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185. The CCPA treats service providers differently than the businesses they serve. (b) The obligations imposed on businesses by Sections 1798.110 to 1798.135, inclusive, shall not apply where compliance by the business with the title would violate an evidentiary privilege under California law and shall not prevent a business from providing the personal information of a consumer to a person covered by an evidentiary privilege under California law as part of a privileged communication. 1798.180 (State Preemption) Enforcement of provisions of law contained in the California Consumer Privacy Act of 2018 amended by this act shall remain in effect and shall be enforceable until the same provisions of this act become enforceable. 3. (I) Professional or employment-related information. Businesses that sell personal information must offer two or more methods for consumers to submit requests to opt-out of the sale of their personal information. You may request that businesses disclose to you what personal information they have collected, used, shared, or sold about you, and why they collected, used, shared, or sold that information. (1) Provide a clear and conspicuous link on the business Internet homepage, titled Do Not Sell My Personal Information, to an Internet Web page that enables a consumer, or a person authorized by the consumer, to opt out of the sale of the consumers personal information. Right to opt-out of sale of personal information; selling minors personal information, Section 1798.125. However, some advertising businesses today use technologies and tools that are opaque to consumers to collect and trade vast amounts of personal information, to track them across the internet, and to create detailed profiles of their individual interests. This section shall not prevent a consumer from declining to request information from a business, declining to opt out of a businesss sale of the consumers personal information, or authorizing a business to sell or share the consumers personal information after previously opting out. (u) Person means an individual, proprietorship, firm, partnership, joint venture, syndicate, business trust, company, corporation, limited liability company, association, committee, and any other organization or group of persons acting in concert. Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumers experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction. Box 85587, San Diego, CA 92186-5587 858-277-6780 Fax 858-277-1876 www.cubic.com NYSE: CUB In the same way that ingredient labels on foods help consumers shop more effectively, disclosure around data management practices will help consumers become more informed counterparties in the data economy, and promote competition. The Attorney General does not represent individual California consumers. (A) Identify the consumer and associate the information provided by the consumer in the verifiable request to any personal information previously collected by the business about the consumer. 1798.199.10. (H) Audio, electronic, visual, thermal, olfactory, or similar information. The specific pieces of personal information it has collected about that consumer. It all stems from California's rather unique ballot initiative process, which is worth explaining in more detail. Another California law, Civil Code section 1798.99.80, defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship. This law exempts certain businesses that are regulated by other laws from this definition. Personal information that is collected by a business that is emergency contact information of the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business to the extent that the personal information is collected and used solely within the context of having an emergency contact on file. 16. Likewise, agreement obtained through use of dark patterns does not constitute consent. For consumers who exercise their right to opt-out of the sale of their personal information, refrain from selling personal information collected by the business about the consumer. 1798.140. This title is a matter of statewide concern and supersedes and preempts all rules, regulations, codes, ordinances, and other laws adopted by a city, county, city and county, municipality, or local agency regarding the collection and sale of consumers personal information by a business. (C) For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists: 1 See California Privacy Rights Act of 2020, 2020 Cal. (j) Device means any physical object that is capable of connecting to the Internet, directly or indirectly, or to another device. (c) A service provider or contractor that assists a business in performing the purposes authorized by subdivision (a) may not use the sensitive personal information, after it has received instructions from the business and to the extent it has actual knowledge that the personal information is sensitive personal information for any other purpose. (B) Identify by category or categories the personal information of the consumer that the business sold in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describes the personal information, and provide the categories of third parties to whom the consumers personal information was sold in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describes the personal information sold. 10. (c) Notwithstanding subdivision (a), a business shall not sell or share the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumers parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumers personal information. ), if it is in conflict with that act. 24.11. Section 1798.199.20 is added to the Civil Code, to read: SEC. (4) Short-term, transient use, provided the personal information that is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumers experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction. A business that collects a consumers personal information shall, at or before the point of collection, inform consumers as to the categories of personal information to be collected and the purposes for which the categories of personal information shall be used. Why is a credit reporting agency still giving out my credit information even though I asked it to delete my information? This category only includes cookies that ensures basic functionalities and security features of the website. A business that offers any financial incentives pursuant to, A business may enter a consumer into a financial incentive program only if the consumer gives the business prior opt-in consent pursuant to. It gives effect to the right to privacy in the California Constitution. (e) Many businesses collect personal information from California consumers. As necessary to further the purposes of this title. (ak) Verifiable consumer request means a request that is made by a consumer, by a consumer on behalf of the consumers minor child, by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumers behalf, or by a person who has power of attorney or is acting as a conservator for the consumer, and that the business can verify, using commercially reasonable methods, pursuant to regulations adopted by the Attorney General pursuant to paragraph (7) of subdivision (a) of Section 1798.185 to be the consumer about whom the business has collected personal information. This title is intended to further the constitutional right of privacy and to supplement existing laws relating to consumers personal information, including, but not limited to, Chapter 22 (commencing with Section 22575) of Division 8 of the Business and Professions Code and Title 1.81 (commencing with Section 1798.80). If you submit a request to opt-out to a service provider of a business instead of the business itself, the service provider may deny the request. (a) In addition to any other available remedies, the agency may bring a civil action and obtain a judgment in superior court for the purpose of collecting any unpaid administrative fines imposed pursuant to this title after exhaustion of judicial review of the agencys action. Service provider means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that processes information on behalf of a business and to which the business discloses a consumers personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the entity receiving the information from retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract for the business, or as otherwise permitted by this title, including retaining, using, or disclosing the personal information for a commercial purpose other than providing the services specified in the contract with the business.