Important Facts About CPRA
While the CPRA is a comprehensive piece of legislation that will require organisations to radically rethink and revolutionize the way they collect and process their users’ information, some basic facts may help establish a firm foundation to initiate their CPRA compliance efforts.
The CPRA amends the CCPA definition of a “for-profit business”. The CCPA stated that businesses catering to at least 50,000 consumers or households qualify as for-profit businesses. The CPRA ups the ante in that regard and states that businesses catering to at least 100,000 consumers or households qualify as for-profit businesses.
The CPRA introduces a new category of data, i.e., sensitive personal information (SPI). Users have a right to request a business to cease the use of their SPI if they fall under CPRA jurisdiction.
The CPRA will be enforced by the California Privacy Protection Agency (CPPA), replacing the California Office of the Attorney General (OAG).
The CPRA introduces provisions such as data minimization, purpose limitation, and storage limitation. These allow users to have a much greater degree of control over how businesses use their data.