On September 22, 2021, the California Privacy Protection Agency (the “Agency”) issued to the public an invitation to submit preliminary comments on proposed rulemaking under the California Privacy Rights Act (CPRA). The Agency is accepting comments on any area on which it has the authority to adopt rules, and specifically on those areas flagged in the invitation. The Agency is “particularly interested in comments on new and undecided issues not already covered by the existing CCPA regulations.” The public has until November 8, 2021 to submit comments.
The areas listed in the invitation to potentially be addressed by the rulemaking process include the following:
- Automated decision-making and consumer choice and transparency;
- Scope of CPPA audit activities;
- The rights to delete, correct, and know;
- Consumer opt-out rights as applied to sales and sharing of personal information and use and disclosure of sensitive personal information; and
- Business obligations to perform cybersecurity audits and submit risk assessments to the Agency when processing presents significant privacy or security risk to consumers.
The public will have the opportunity to provide additional comments on proposed regulations when the Agency issues a notice of proposed rulemaking (NPRM), which is anticipated to follow later this year.
The invitation, including instructions on how the public may submit comments, may be found here.
