Businesses with operations in California should expect their data privacy compliance obligations to get a lot more complicated next year.
That’s because voters may choose to replace the California Consumer Privacy Act (CCPA)—the country’s only currently enacted data privacy law, which took effect Jan. 1—with the California Privacy Rights Act (CPRA). The Nov. 3 California state ballot asks voters to approve Proposition 24 and enact the CPRA. The law would expand the definition of sensitive personal information and add a host of new data collection, use, and storage compliance requirements for businesses, many of which are still struggling to comply with the CCPA.
