CCPA Update: Proposed Regulations Published by Attorney General

The Office of the Attorney General has released the long-anticipated proposed CCPA regulations. The proposed regulations outline procedures intended to facilitate consumers’ new rights under the CCPA and provide compliance guidance to businesses regarding:

  1. Notices businesses must provide to consumers under the CCPA;
  2. Handling consumer requests made pursuant to the CCPA;
  3. Verifying the identity of the consumer making those requests;
  4. Personal information of minors; and
  5. Nondiscrimination and offering of financial incentives.

Please see our Alert for a detailed discussion of the proposed regulations.

CCPA Amendments Signed by Gov. Newsom

Governor Gavin Newsom signed five CCPA amendment bills into law on Friday, October 11, 2019.  He also signed an amendment broadening the California breach notification law and a new law which creates a data broker registry for the sale of certain personal information.  The event marked the culmination of the California Legislature’s efforts this year to clarify the terms and scope of the CCPA, which takes effect on January 1, 2020.

A summary of these laws and their impact may be found in our previous Alert.

Stay tuned to the Duane Morris TechLaw Blog for developments regarding the CCPA and its implementation.

Supreme Court Passes on Challenge to Extension of Title III to Websites and Mobile Apps

On October 7, 2019, the Supreme Court of the United States issued an order denying certiorari in Domino’s Pizza, LLC v. Robles, a case that would have required the Supreme Court to determine the application of Title III of the Americans with Disabilities Act (ADA) to websites and mobile applications. The Supreme Court’s order means a Ninth Circuit decision applying Title III to websites and mobile apps will stand, even in the absence of Department of Justice-promulgated regulations outlining applicable compliance standards.

On September 1, 2016, Guillermo Robles, who is visually impaired, filed suit in the U.S. District Court for the Central District of California. He alleged that Domino’s website and mobile app were incompatible with his chosen screen-reading software, and thus violated Title III of the ADA, among other statutes. Domino’s moved for summary judgment, in part on the basis that Title III of the ADA does not extend to its website or mobile app. The District Court found that Title III did apply to Domino’s website and app, but granted summary judgment on the grounds that imposing liability on Domino’s without clear standards for satisfying Title III obligations would violate the company’s due process rights. Robles then appealed.

View the full Alert on the Duane Morris LLP website.

Nevada Privacy Law Takes Effect October 1: Is Your Company Compliant?

The newest Nevada privacy law, SB 220, is about to become operative on October 1, 2019, and will require website operators to provide consumers with the right to opt out of the sale of their personal information. The definition of what constitutes a “sale” is fairly narrow and includes several broad exclusions. Therefore, this opt-out provision is likely to apply only in narrow circumstances. However, businesses that may be covered by this new law will need to complete the following items prior to October 1:

  1. Determine whether the law applies to your business.
  2. Confirm compliance with existing consumer notice requirements.
  3. Establish a designated request address where consumers may submit a verified request to opt out of the sale of their covered information.
  4. Develop policies, procedures and processes for verifying and responding to requests within 60 days.

Please see our Alert for a detailed discussion of this law and when it applies.

Amendments to the CCPA Ready for Governor’s Signature

By:  Michelle Hon Donovan, Brandi Taylor and Angelica Zabanal

Last Friday, September 13, 2019, marked the final day for the California Legislature to vote to pass amendments intended to clarify the terms and scope of the California Consumer Privacy Act (CCPA), which takes effect on January 1, 2020. The bills are now on Governor Gavin Newsom’s desk for approval, and the Governor will have until October 13, 2019, to sign or veto them.

Of the CCPA amendment bills that were in consideration, the following were passed:

  • AB 25, regarding employee exemption
  • AB 874, regarding the definition of PI (personal information)
  • AB 1146, regarding warranty and vehicle repairs
  • AB 1355, regarding the B2B exemption and other clarifying amendments
  • AB 1564, regarding toll-free telephone number exception

Also of note, AB 1130 – a bill that does not specifically amend CCPA – also passed. This bill expands the categories of PI covered by California’s data breach notification laws, which will now include tax identification numbers, passport numbers, military identification numbers and unique identification numbers issued on a government document, as well as certain types of specified unique biometric data. This expansion is anticipated to impact liability under the CCPA’s private right of action

While not an exhaustive list of the bills that stalled during the legislative process, the following bills of note failed to be passed by the legislature:

  • AB 873, regarding the definition of de-identified
  • AB 846, regarding customer loyalty programs
  • AB 981, regarding exemption for certain insurance transactions

While the approved amendments did not significantly overhaul the CCPA, several notable changes were made. Please see our Alert for a detailed discussion of these changes.

Your Smartphone: Friend or Foe?

Wherever we go these days, whether at work, at home, in restaurants, outside, or practically anywhere else, people reflexively go to their smartphones constantly.

Why? Because those little handheld devices can accomplish so much. We can send communications across various platforms, conduct business tasks, check on the news, shop, participate in social media, listen to music, watch videos, and the list goes on and on. Continue reading Your Smartphone: Friend or Foe?

Staying Ahead of Rampant Cyber-Attacks

Since the advent of the most rudimentary technology, criminal activity has followed. And in more recent times, the internet certainly has been no stranger to criminal enterprises. Indeed, governmental entities, companies and individuals are falling victim to all sorts of cyber-crimes on a constant basis. A look at just one criminal target drives home the rampant nature of online attacks.

Brace yourself for this – the City of London Corporation suffered almost one million cyber-attacks monthly for the first quarter of 2019, based on information obtained by Centrify as reported by info security-magazine.com. That indisputably is a phenomenal number of attacks on the local authority which oversees capital housing for a good portion of the financial center in London. Continue reading Staying Ahead of Rampant Cyber-Attacks

What To Do About CDA Section 230 And ISP Immunity?

Section 230 of the Communications Decency Act (CDA) became law long ago when it comes to internet time, way back in the 1990s. The main thrust of the CDA was an effort by Congress to regulate indecent content posted online. Section 230 was included within the CDA to provide general immunity to Internet service providers with respect to third-party content posted on their sites. While the indecency regulatory aspect of the CDA was struck down by the United States Supreme Court as violating the First Amendment, Section 230 survives to this day and has been the critical legal backbone that has allowed a good part of the Internet to flourish, especially social media. Continue reading What To Do About CDA Section 230 And ISP Immunity?

European Union Seeks to Update and Centralize Internet Law

While issues relating to Brexit and Boris Johnson becoming the Prime Minister of England have tended to dominate the news across the pond, not to be lost in the shuffle are reports that the European Union is in the process of creating a new law that would add further regulation of online content. The new law, titled the Digital Services Act, seeks to replace an older commerce directive from two decades ago with an updated and legally binding law. The law is reported to address a wide array of digital platforms and supposedly would focus on all aspects of tech.

So, what are some of the reported features of the Digital Services Act? Continue reading European Union Seeks to Update and Centralize Internet Law

California Consumer Privacy Act (“CCPA”) Amendments One Step Closer to Passage

By Angelica A. Zabanal

When the California Consumer Privacy Act (“CCPA”) was passed last year, it was generally acknowledged that the CCPA would need to be clarified prior to its January 1, 2020, implementation. A variety of CCPA amendments are now one step closer to full passage.

Last month, the California Senate Judiciary Committee passed seven amendment bills to the California Consumer Privacy Act (“CCPA”).  The bills are now headed to the Committee on Appropriations for a vote. Any bills amended by the Senate will need to return to the Assembly for a vote and a possible reconciliation.  Lawmakers have until September 13, 2019 to vote on these CCPA amendments, which are summarized in their current form below:

  • B. 25 (regarding Employee Exception):  Amends the CCPA so that it excludes the collection of personal information (“PI”) from job applicants, employees, business owners, directors, officers, medical staff, or contractors, who would not be considered as “consumers” under the CCPA.  Now amended to weaken the employee exception with a sunset exemption on January 1, 2021 and negating the exemption as it pertains to the CCPA’s notice and data breach liability provisions;
  • B. 846 (regarding Customer Loyalty Programs):  Excludes application of certain prohibitions in the CCPA to loyalty or rewards programs.  Now amended to prohibit a business from selling consumer PI that was collected as part of a loyalty, reward, discount, premium features, or club card program;
  • B. 1202 (regarding Data Brokers):  Requires data brokers to register with the California Attorney General.  Now amended to exclude language that would have provided consumers the right to opt-out of the sale of their personal information by data brokers;
  • B. 1564 (regarding Disclosure Methods):  Requires businesses to provide consumers with two methods for the submission of privacy requests, including a toll-free telephone number at a minimum.  Excludes smaller online companies from the toll-free number and allows these companies to provide an email address for submitting privacy requests;
  • B. 1146 (regarding Warranty and Vehicle Repairs):  Exempts vehicle information retained or shared for purposes of a warranty or recall-related vehicle repair.  Now amended to provide a clearer description of vehicle recalls;
  • B. 874 (regarding “Publicly Available” Information):  Expands definition of “publicly available” to include information that is lawfully made available from federal, state, or local government records.  Amends definition of “personal information” to exclude de-identified or aggregate consumer information.  (Approved by the Judiciary Committee without amendments);
  • B. 1355 (regarding Opt-In Clarification):  Exempts de-identified or aggregate consumer information from the definition of PI.  Also clarifies that consumers over 13 years of age but younger than 16 years of age are required to opt in. Furthermore, parents need to authorize consent only for consumers under 13 years of age. (Approved by the Judiciary Committee without amendments.)

Stay tuned for more updates from Duane Morris LLP regarding the advancement of these CCPA amendments and join us for our CCPA webinar series.