Update—Important Amendments to the California Consumer Privacy Act of 2018: California State Legislature Amends Recently Enacted California Privacy Statute to Include Key Clarifications and Additional Exemptions for Businesses

Sullivan & Cromwell LLP - September 6, 2018
Read More

On August 31, 2018, the California State Legislature passed a bill, SB-1121 (the “Amendments”), amending the recently enacted California Consumer Privacy Act of 2018 (the “CCPA”).  The CCPA, which was enacted on June 28, 2018 and is scheduled to take effect on January 1, 2020, sets forth numerous rules for businesses that collect, transfer, or sell a customer’s personal information.  The key changes to the CCPA in the Amendments include: a clarification that, with the exception of a CCPA provision creating a private right of action for certain data breaches, the CCPA does not apply to information collected, processed, sold or disclosed pursuant to Gramm-Leach-Bliley Act (“GLBA”), its implementing regulations and the California state analog to GLBA; an expansion of exemptions related to certain medical information to apply to “business associates” (as that term is defined in the applicable federal regulation), as well as health care providers and covered entities who are subject to applicable state and federal laws; the creation of a new exemption for noncommercial press activities protected by Section 2(b) of the California Constitution; the correction of a constitutional defect contained in the CCPA’s penalty provisions and the addition of an injunctive remedy for the California Attorney General; an extension of the deadline by which certain implementing regulations must be adopted by the California Attorney General, as well as a prohibition on enforcement actions by the California Attorney General until the earlier of: (i) July 1, 2020, or (ii) six months after the publication of such final regulations; the elimination of the need for consumers to provide notice to the California Attorney General before proceeding with private litigation related to certain data breaches and other technical changes.