CPPA seeking comment on cybersecurity audit, risk assessment rule adds
By 
Adrianne Appel2023-02-13T19:00:00
The California Privacy Protection Agency (CPPA) is seeking comment on privacy rules requiring certain large businesses to conduct annual cybersecurity audits and risk assessments if the state believes they are placing consumer data at risk.
The California Privacy Rights Act (CPRA) mandated the agency write cybersecurity audit and risk assessment rules for businesses whose processing of consumer personal data presents “significant risk to consumers’ privacy or security,” according to the CPPA’s request for comments published Friday.
The agency also will write rules concerning use of automated decision-making technology by businesses regarding consumers’ opt-out rights and their access to data.
Related articles
-
PremiumCPPA eyeing broad scope in early discussions around data risk assessments
Draft risk assessment regulations under the California Consumer Privacy Act are designed to prohibit businesses from handling consumer data if uncontrolled risks—to the security and privacy of the consumer, the public, or the business—outweigh the benefits.
-
News BriefLatest CCPA sweep targets employee, applicant info protections
The California Office of the Attorney General has turned its attention to the practices of large companies regarding the protection of the personal information of employees and job applicants as part of its latest investigative sweep under the California Consumer Privacy Act.
-
OpinionLegacy of CCPA: A blueprint for prioritizing compliance
Three years in, the promise of the California Consumer Privacy Act as a means of handing down eye-watering penalties against companies for data protection violations remains unfulfilled. And yet, the expanding U.S. data privacy legislation landscape is better for this.
More from Regulatory Policy
-
ArticleWhat is AI washing and why companies need to stop exaggerating their AI prowess
The buzz around generative AI has reached fever pitch over the past few years—to such an extent that it’s practically a death knell for any company to say it’s not investing massively in gen AI to transform their business. There’s only one problem: many companies are either being misleading or ...
-
News BriefApple, Google face compliance crossroads as states push digital safeguards
A new law in Texas will go into effect next January that requires Apple and Google to verify the age of their app store users. This marks another piece of legislation from the state level intended to protect children, and the second such law specifically from Texas to limit children’s ...
-
Basic PageConsumer electronic supply chain at risk, FCC says in proposing new rules
Thousands of computers and other consumer electronic devices imported into the U.S. that were certified as safe by foreign laboratories have been identified as having links to the Chinese government or military, Brendan Carr, chair of the Federal Communications Commission, said Thursday in announcing an order to close the security ...