On Monday, February 10th, the California Attorney General’s office released an updated version of the proposed regulations, addressing errors in the draft released before the weekend and extending the comment period to February 25 at 5pm PST. For those trying to keep track of what the eventual regulations will require, the challenge is greater than the AG’s version control. MediaPRO reported on February 11th in their 2020 State of Privacy and Security Awareness Report that almost two-thirds of U.S. employees are unaware if the CCPA applies to their organization. This presumably translates to confusion at the business level or at least a poor job of those subject to the CCPA communicating this internally.
While the AG’s redline of the updated draft rules demonstrates that a great deal of time and thought (and, ahem, lobbying) have been put into the effort, what would be helpful is if the AG included a detailed explanation of why the changes have been proposed. Some make sense, and some continue to baffle. Onward to some of the most impactful of the proposed changes.
When Is a Household Not a Household? The original definition was that a person or group occupy the same dwelling. This made imminent sense but was impractical absent a common identifier such as a street address. The proposed change largely guts the household aspect of the CCPA because a business would now need to know that: 1) the individuals reside at the same address, 2) they use a common device (smart TV?) or the same service (ISP? AppleTV? Netflix?), and 3) the business identifies these individuals as sharing a group account or a common identifier. The revised definition sharply narrows the impact of the statute’s text, but also corrects for what many perceived as an odd (at best) component of a privacy law centered on individual data.
[…]
This is an extract. Read the complete article at the original source by clicking the link below.