The REAL WINNER of the election is Data Privacy for Californians with CPRA / CCPA 2.0

Last night in the California elections Proposition 24 passed with 56% support, paving the way for an upgrade to the California Consumer Privacy Act with a new bill titled the California Privacy Rights Act 2020.

The precursor to CPRA, the CCPA, was signed into law in June 2018 and became effective on January 1st 2020.

What is the California Consumer Privacy Act?

The goal of the original legislation was very much in the sprit or Europe's General Data Protection Legislation and is focused on consumer protection and the right to privacy. The law aims to ensure that consumers understand what personal data is being collected about them, whether that data is being sold or disclosed and to whom. Again, much like GDPR It gives consumers the rights to object to the sale of personal data, the right to access that data and to request that organisations delete any personal data along with some assertions that personal data should not be used to discriminate about individuals.

There are some differences with GDPR in that organisations do not have to provide a 'legal basis' for processing personal data, nor do they have to appoint a Data Protection Officer. On the other hand CCPA requires stricter privacy policies and it also enforces the inclusion of a "Do Not Sell My Personal Information" link on websites and apps.

What is the California Privacy Rights Act?

CPRA isn't a whole new piece of legislation, it expands on the existing CCPA by providing additional requirements and adding some clarifications.

One area where the law has been clarified is in specific provision for “cross-context behavioral advertising” - basically ad tracking across sites. Now users will have a specific option to opt-out of this kind of third-party tracking.

CPRA also adds the ability for citizens to correct or rectify their personal data, something GDPR already had but was absent from CCPA. Another area where parity is reached is in adding the classification of Sensitive Personal Information (SPI) which includes heightened protections for data such as race, releigion, ethnicity, precise location, genetic data, financial information, health data and sexual orientation.

What is the impact of CPRA?

It's too early to tell at this stage but certainly those in the advertising space will be watching it carefully and it's almost certainly going to have an impact on the likes of Google, Facebook and Twitter whose revenue comes predominantly from advertising.

In a more national sense California is becoming a bit of a leader in this space so I'd expect legislators across the nation to be watching the success of Prop 24 with eyes on their own constituencies. Here's iapp's latest comparison of state-wide privacy laws as of today...

One thing that's pretty likely though that you'll see even more annoying popups on websites asking for permission - but it's perhaps a small price to pay for an enhanced right to privacy.