Last month, the Office of the Attorney General of California released a second set of modifications to the proposed regulations for the California Consumer Privacy Act (CCPA). There are three key changes. The first is the removal of a prescribed “opt-out” button from the regulations. Some experts urged this move after concluding that the opt-out button regulation, as written, was inconsistent and impractical. The second change was placing a limitation on the linking of personal information to internet protocol (IP) address, implicitly expanding the definition of “personal information.” Finally, the amended regulations require additional disclosure to users in privacy policies with respect to which types of data are being collected and the business purpose for which it is being collected.
Two class action lawsuits have been initiated in the past month explicitly raising CCPA causes of action. Both claims are active and in preliminary stages.
In Fuentes v. Sunshine Behavioral Health Group, LLC, a Pennsylvania resident representing the class claims that his information was mishandled under CCPA requirements while he was a patient of Sunshine in California. The claim is unlikely to survive to discovery due to issues in standing and timeliness of the claim.
In Cullen v. Zoom Video Communications Inc., Californian users of the Zoom video conferencing software claim violations of the CCPA through unauthorized disclosure of personal information. Zoom’s data privacy issues have been well documented through leaked documents, subsequent admission by the company of certain privacy issues, and the public phenomena of “zoombombing” where uninvited guests join video conferences, often with mal-intent.
An advisor to California Attorney General Becerra in responding to a question about delaying CCPA implementation due to COVID-19, said that their office is committed to the original timeline for the implementation of the regulations. Although the CCPA became effective on January 1, 2020, enforcement by the attorney general will begin on July 1, 2020, or when final regulations are posted, whichever is sooner.