• Skip to primary navigation
  • Skip to main content
  • Skip to footer
The Evolution of ESG RegulationThe Evolution of ESG RegulationThe Evolution of ESG Regulation

CUBE global

  • Products
        • RegPlatform product overviewOur enterprise product, providing regulatory intelligence for large, global financial institutions looking to tackle complex compliance.
        • RegAssure product overviewOur highly intuitive, seamless compliance product, that grows with your small or medium sized business.
        • CUBE's technology
  • Solutions
        • PrivacyGlobal governance for data privacy regulations, the world over
        • RecordsHolistic oversight of ever-growing regulations for records
        • CybersecurityAutomated workflows for up to date, relevant data on cyber
        • Technology riskEffective policies and controls to mitigate technology risk
        • Financial crime and AMLWatertight audit trails to show risk-based rationale
        • View all solutions
  • Resources
        • Resource hubLifting the lid on financial services, compliance, and regulation
        • Read

        • Case Studies
        • Blog posts
        • Reports
        • RegNews
        • Brochures
        • Find

        • Compliance Corner
        • Compliance Confessions
        • ESG Conference
        • CUBE’s regulation game
        • Listen

        • Videos
        • Webinars
        • Podcasts
  • Partners
        • Advisory and consulting partnersEnhance your regulatory compliance offering with the entire suite of CUBE regulatory data.
        • Integration partnersCompliance is complex enough without over-complicated integration procedures.
        • Technology partnersAdd value to existing customer applications with a unified window into regulatory intelligence.
        • Partners overview
  • About us
        • About usThe story of who we are, how we got here and why we’re exceptionally proud of what we do
        • TeamThe visionaries and leaders powering CUBE’s success
        • NewsThe latest news from CUBE
        • CareersOur movement to transform regulatory data into regulatory intelligence
        • ContactWant to know more? Get in touch
  • Request a demo
Customer login
Home » Resources » California Consumer Privacy Act 2023 Update

February 17, 2023

Estimated reading time: 4 minutes

California Consumer Privacy Act 2023 Update


Prior to data protection legislation, there were several high-profile data breaches in the US. From Zoom’s $85 million settlement to T-Mobile’s data breach, the common denominator in each of these cases was clear: poor data controls and messy access management.    

The California Consumer Privacy Act (CCPA) was introduced to solve that problem. In protecting consumers, the regulation provided guidance for large companies operating within the state or serving customers who reside in California.

In 2023, there have been several updates that regulated companies need to know about. With a recent crackdown on non-compliance, it is certainly something for regulated entities to get ahead on. 

Background

The CCPA was first introduced in order to protect the rights of consumers living in the state. It aimed to regulate companies that (intentionally or otherwise) collected and processed data from these consumers. Since the State of California alone would make up the world’s fifth-largest economy, it’s no wonder that regulators focussed on protecting consumers.  

The CCPA’s main aim was around disclosure: companies must let consumers know what data they were collecting, and for what the information was being used. Moreover, the Act made it clear to consumers that they had the right to opt out of any data collection without fear of retaliation.  

Several other states have followed suit with their own privacy law. Namely, the Colorado Privacy Act arrived in quick succession, and later Virginia state launched their own consumer protection laws. So, it looks like the buzz around data protection and cybersecurity doesn’t seem to be going anywhere, anytime soon. 

2023 updates to the CCPA

As a result of the California Privacy Rights Act (CPRA), which has come into effect on 1 January 2023, there are a few updates that might change your company’s compliance duty:

  1. Worker data rights
  2. Added consumer privacy rights.

Worker data rights

When it was initially introduced, the CCPA allowed employees or employee-adjacent personnel (such as independent contractors) to be exempt from the regulation. This meant that companies did not have to extend their data collection and processing protocols internally to employee data.  

Now though, regulated companies must respect the following California privacy rights of workers, who can:

  • Ask what data is being kept on them
  • Ask to correct any inaccurate data, or delete it altogether
  • Ask what data is shared with third parties
  • Ask that data is not shared or sold to third parties 

This applies to California employees, independent contractors,  applicants for a role along with their emergency contacts and beneficiaries. 

Added consumer privacy rights

For a quick recap, the original version of the CCPA focussed on regulating businesses to act in the interest of their California resident customers. With huge amounts of data being collected and processed by companies operating with Californian customers, some corporations were set to make millions in the sharing and selling of that data. 

Therefore, this data privacy law was launched with a particular focus on the protection of consumer data. 

Now, CCPA compliance means that businesses must adhere to two more consumer rights under Californian law: 

  1. Individuals have the right to correct any inaccurate personal information that a business holds about them.
  2. Individuals have the right to limit the use and disclosure of their sensitive personal information. 

It is important that companies make the distinction between personal information and sensitive personal information. This is because the way that businesses are allowed to treat this data varies. Sensitive personal information refers to identifiable data, such as a social security number. 

No room for non-compliance

Just last month, the California Attorney General’s Office notified mobile apps in the retail, travel and food industries of violations of the CCPA regulation. These notifications are likely due to non-compliance with their privacy policies or data processing practices, prior to the updates. 

However, the public nature of this announcement means that the Californian government seems to be stepping up their efforts around compliance. It also means that any service provider that operates in California or serves Californian customers, should stay ‘on their toes’ in reaction to any future CCPA updates.  Moreover, the fines for non-compliance with this regulation have been well-documented. Civil violations of the privacy legislation have been listed as a maximum fine of $2,500 per violation, with intentional violations increased to a fine of $7,500. Plus, companies should be aware that in not complying with the CCPA, they’re exposed to legal action by their customers, too. 

How to stay compliant

Staying on the right side of compliance isn’t easy, but with an increased focus on the CCPA by the government, it matters now more than ever. Moreover, consumers’ personal information is a hot commodity and must be protected as global privacy control continues to change.  

CUBE RegPlatform can help your enterprise manage its regulatory intelligence, all the way down to the jurisdictional level. Operating globally means complying with local regulations, which can be a pain to manage. But your team can breathe easy when they use CUBE’s RegPlatform, which uses horizon-scanning technology to show you exactly what is around the corner. 

Keep ahead of your CCPA obligations by speaking to CUBE.


Speak to CUBE

Related resources
View all articles
Blogs

The crackdown on crypto continues 

Recent US and UK crypto regulation developments
Blogs

Taming the crypto wild west: the US and UK strengthen regulation

SEC cracks down on fraudulent crypto activity
Blogs

The SEC’s crackdown on fraudulent crypto activity

cryptocurrency and global financial inclusion
Blogs

How will embracing cryptocurrency bring global financial inclusion?


Want CUBE updates and latest industry news sent straight to your inbox?

Footer

Add CUBE logo here

  • Products
    • Partners
    • Solutions
  • Resource hub
    • Blogs
    • Reports
    • Brochures
    • Compliance Corner
    • Webinars
    • Podcasts
    • Videos
  • Behind CUBE
    • About us
    • Meet the team
    • Careers
    • News
    • Contact us
  • The legal bits
    • Privacy policy
    • Cookie policy
    • Terms of use
    • Accessibility
Follow us:
  • LinkedIn
  • Twitter
  • YouTube

© 2023 CUBE Content Governance Global Limited

  • English
  • US

envelope

Want CUBE updates and latest industry news sent straight to your inbox?

Sign up to our Newsletter here