Countdown to CCPA – California Attorney General Releases Proposed CCPA Regulations

On October 10, 2019, the California Office of the Attorney General (OAG) released its highly-anticipated proposed text of California Consumer Privacy Act (CCPA) regulations, a procedure required by the statute. For many businesses still shoring up their California Consumer Privacy Act (CCPA) compliance, interpreting some of the finer language of the law has been one of the largest obstacles, and privacy professionals and business executives alike have waited for the OAG to provide more details on the law’s most confusing language. The text of the CCPA, for example, does not clearly define “reasonable security measures” for responding to a consumer’s data access request and similarly does not provide examples of “reasonable methods” for verifying identity. While textual uncertainty combined with frequent comparisons of the CCPA to the E.U.’s General Data Protection Regulation (GDPR) have naturally led many privacy professionals to craft comparable definitions of reasonableness and utilize parallel examples for verifying identity, much of the CCPA compliance process has thus far been an admittedly imprecise science. The OAG’s proposed regulations are welcome clarifications and instructions.

For those following along with our “Countdown to CCPA” client alerts (available here and here), we will soon provide detailed summaries of the most significant guidance from each Article in the OAG’s regulations. The OAG’s regulations address a variety of topics from privacy policy content to data subject request response. For now, we ask our clients to monitor our Ice on Fire Insights for updates coming soon. If you wish to view the OAG’s full proposed text, please click here.

Ice Miller has the professionals and experience to help clients develop cybersecurity and privacy programs to comply with the requirements of the CCPA. To speak to an attorney, please contact Nick Merker or Mason Clark. Nick Merker is a partner and co-chair of Ice Miller’s Data Security and Privacy Practice Group. Mason is an associate in Ice Miller’s Data Security and Privacy Practice Group.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader’s specific circumstances.