The California Consumer Privacy Act (CCPA) was enacted into law on June 28, 2018 and became effective on January 1, 2020. CCPA provided a variety of consumer privacy rights and the obligations of business related to their storage and sale of personal information.
Voters in California voted to approve Proposition 24, a ballot measure, on November 3, 2020, which created the California Privacy Rights Act (CPRA). The purpose of CPRA was to modify and expand the requirements of the CCPA, thus amending the original act. CPRA is commonly referred to as “CCPA 2.0.”
CPRA ends the ban on providing the CCPA’s consumer privacy rights to a company’s employees. Under CPRA, all employers must respond to requests from employees to access or correct their personal data. Enforcement of CPRA will become effective in July 2023, enabling companies six months to ramp up their efforts to comply with it.
CPRA also extends new protections to consumers residing in California. Those organizations doing business with these consumers are subject, based on defined threshold of operation, to the compliance requirements.