Klein Moynihan Turco’s Response to COVID-19 – Click here

Klein Moynihan Turco

Data & Privacy Law

CCPA Opt-Out Changed?

by David Klein

On October 12, 2020, the California Department of Justice released a third set of proposed modifications to the California Consumer Privacy Act (“CCPA”) regulations. The CCPA regulations had been approved by the California Office of Administrative Law (“OAL”) and made effective on August 14, 2020. This third set of modifications provides additional clarification on: 1) CCPA opt-out methods; 2) authorized agent requests; and 3) privacy policy disclosures of businesses selling the personal information of consumers under sixteen (16) years of age. Please note that the California Department of Justice will accept written comments on the proposed changes until Wednesday, October 28, 2020, at 5:00 P.M.

What are the details of the proposed modifications?

[Read More]

CCPA Amendment Passes, Creating New HIPAA-related Exceptions

by David Klein

On September 25, 2020, California Governor Gavin Newsom signed AB 713 (the “Amendment”) into law, amending the California Consumer Privacy Act (“CCPA”) to implement exceptions related to consumer health data. Specifically, the CCPA amendment addresses inconsistencies between data protection afforded under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the CCPA, respectively. The Amendment took effect on September 30, 2020. 

What does the CCPA Amendment cover?

[Read More]

App Law and Future Changes to iOS Privacy

by David Klein

Apple’s forthcoming iPhone operating system, iOS 14, will overhaul how apps and advertisers disclose their privacy practices to consumers. Critically, apps will soon need their users to provide opt-in consent to the sharing of advertising identifiers. These changes are not only significant due to the size of Apple’s user base, but also because Apple’s practices may well shape the development of privacy and app law across the country.  

What Changes Should Advertisers Expect?

[Read More]

Refresher Course on California Anti-Spam Law

by David Klein

Recently, much has been written about the newly-enacted California Consumer Privacy Protection Act (“CCPA”). With all the attention (rightfully) being given to the CCPA, we wanted to remind readers that the CCPA is merely one of several consumer privacy laws currently on the books in the state of California. The California Anti-Spam Law, codified at Section 17529 of the California Business and Professions Code, although less discussed, is still a very important statute and can result in large fines for unwary email marketers. 

What does the California Anti-Spam Law Prohibit?

[Read More]

CCPA 2.0 on California’s November Ballot

by David Klein

Although it feels just like yesterday that the California Consumer Privacy Act (“CCPA”) went into effect (it was January 1, 2020), California may be at it again. After securing 931,000 signatures from California State residents, the privacy-right activist group, Californians for Consumer Privacy, has qualified yet another privacy bill for the November 3, 2020 ballot. The California Privacy Rights Act (“CPRA”), which some are calling CCPA 2.0, would expand the privacy rights of Californians with enforcement set to begin on January 1, 2023.

What is CCPA 2.0?

[Read More]

CCPA Enforcement has Begun

by David Klein

Although the California Consumer Privacy Act (“CCPA”) went into effect on January 1, 2020, the California Attorney General (“AG”) was prohibited from bringing enforcement actions until July 1, 2020. Due to the COVID-19 pandemic, some observers were unsure whether the AG would be able to meet the July 1st deadline. However, the AG is moving full speed ahead and has even denied businesses’ requests to delay the CCPA enforcement date due to COVID-19. Now, the AG has commenced enforcement action as planned, and businesses have already started to receive CCPA violation notices. 

What should you do if you receive a CCPA violation notice?

[Read More]

CCPA Compliance: The CA Attorney General is Enforcing Now!

by David Klein

With the outbreak of the COVID-19 pandemic, businesses have had to react to a whole new set of issues that were not on their radar four (4) months ago.  One task that may have been tabled until some sense of normalcy was restored is compliance with the California Consumer Privacy Act (“CCPA”). Businesses must be aware that July 1, 2020, marked the day that the California State Attorney General’s Office began its CCPA enforcement efforts. Attorney General Xavier Becerra announced the enforcement date by releasing a statement encouraging “every Californian to know their rights to internet privacy and every business to know its responsibilities.” Although it is too early to know what enforcement will look like, businesses that are not already within CCPA compliance must act fast to avoid stiff penalties. 

What are the immediate responsibilities businesses should be aware of?

[Read More]

CCPA Service Provider Agreements: Accounting for the California Consumer Privacy Act (CCPA)

by David Klein

With the enforcement of the California Consumer Privacy Act (“CCPA”) commencing on July 1, 2020, many businesses should be taking a close look at their CCPA service provider agreements.  By way of background, the CCPA is a consumer-friendly privacy law that applies to various entities and their respective service providers.  The CCPA provides consumers with protections and choices with respect to how their personal information is collected, used and shared by businesses and other entities.  Consistent with the foregoing, the CCPA requires businesses to ensure that their service providers and other third-party partners refrain from exploiting the personal information that is shared with them.  

The CCPA defines “service provider” as any entity “that processes information on behalf of a business and to which the business discloses a consumer’s personal information for a business purpose pursuant to a written contract.”  Further, the CCPA contains an expansive definition of “personal information,” which includes “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”  

Based on the foregoing, if they have not already done so, companies need to: 1) revise CCPA service provider agreements on a going-forward basis; and 2) draft CCPA-compliant amendments to existing agreements to ensure that their respective service provider partners are contractually obligated to refrain from using consumer information for prohibited commercial purposes. 

Should I Revise My Service Provider Agreements for CCPA Compliance Purposes? 

[Read More]