Attorneys who have to guide companies through the CaliforniaConsumer Privacy Act (CCPA) would like clarification sooner, notlater, on the proposed regulations the state's attorney general setout last year.

In October, California Attorney General Xavier Becerra released24 pages of draft regulations concerning the CCPA that willbe finalized by July 1, 2020, at the latest. The date issignificant because Becerra has said that his office will not beginenforcing the law until then.

"For the most part, we are assuming that the proposedregulations will be implemented as they were initially drafted,"Michelle Hon Donovan, a partner at Duane Morris in San Diego, said.

She said there is no clarity on some of the definitions, andbusinesses will need to be given direction in order to comply withthe law, which came into effect on Jan. 1. Issues requiringadditional clarification include a definition of personalinformation. The proposed rule says: "A business shall not providea consumer with specific pieces of personal information if thedisclosure creates a substantial, articulable, and unreasonablerisk to the security of that personal information, the consumer'saccount with the business, or the security of the business'ssystems or networks."

"That language is unclear and can be interpreted very broadly,"Hon Donovan said.

Jean-Marc Chanoine, global head of strategic accounts and legalcounsel at Templafy in New York, said while there is a grace periodnow, the California Office of Attorney General will ultimately begoing after companies for minute procedures in which the languageon how to comply is vague.

For example, if someone requests what information a company hason them, a company may need to collect more information on thatperson to verify they are not a bad actor trying to stealinformation. There are questions, Chanoine said, on whether that isallowed and how long a company can retain that additionalinformation.

"Anyone can request information on data that is being collectedon them," Chanoine said. "That data could be used by bad actors.How are companies supposed to know what is a legitimaterequest?"

Chanoine said while the attorney general is not aiming to punishcompanies that are trying to do the right thing, the attorneygeneral still has not defined which efforts wouldshow good faith and which would not.

Chanoine would like to see some kind of protection for companiesfrom frivolous class-action lawsuits. One of the most notablechanges to the CCPA is that consumers now only have a private rightof action for a data breach. If the suit is successful, consumerswho have their data exposed in a breach can be given anywhere from$100 to $750.

"What is the attorney general doing to make sure there are notabuses in class-action lawsuits?" Chanoine asked. "Let's make surewe're protecting consumers and companies, and not causing more harmthan good."

The timing is what is largely concerning to clients, said JimHalpert, a partner at DLA Piper in Washington, D.C. He said some ofthese changes would take a while because there is no technology tohandle some of the proposed requirements. One involves having "donot sell" notices that could be sent through a browser signal,Halpert explained.

"There is not the technology to do this, and it is unclear how,beginning on July 1, businesses would be able to comply with that,"Halpert explained. "The CCPA has been a moving target, and theregulations include some new ideas which are a little difficult forentities to comply with."

From: Legaltech News