The California Privacy Protection Agency has been hard at work since its creation in 2021. It has been raising general awareness of the California Consumer Privacy Act (CCPA), hiring staff in order to begin enforcement, and drafting new regulations that have a big impact on CCPA compliance.

In recent months, the Agency’s regulatory efforts have been focused on two key areas: cybersecurity audits and risk assessments. The CCPA itself requires the Agency to create these regulations, and also gives it a great amount of leeway in deciding how to do so. For these reasons, the business community has been eagerly awaiting news of what the regulations might look like.

Though the new rules are only in the draft stage and are far from finalized, they do give us a general idea of what to expect.

Cybersecurity Audits

tl;dr: Larger businesses would be required to perform in-depth cybersecurity audits on annual basis.

Though it’s often overlooked, cybersecurity is an important part of CCPA compliance. Businesses have a duty to implement and maintain “reasonable security procedures and practices”; if a business fails to do so and this results in a data breach, it can actually be sued under the CCPA for up to $750 per consumer whose data is affected.

In order to ensure greater security of consumers’ data, the Agency is introducing rules concerning mandatory cybersecurity audits. The proposed audits would be quite substantial, and in recognition of this the Agency is seeking to limit their application based on the size of the business. It has proposed a few different options for when these audits would be required, but seems to be leaning toward something like this:

The business has annual gross revenues in excess of $25 million in the preceding calendar year AND

• Processed the personal information of one million or more consumers in the preceding calendar year; or
• Processed the sensitive personal information of 100,000 or more consumers in the preceding calendar year; or
• Processed the personal information of 100,000 or more consumers that the business had actual knowledge were less than 16 years of age in the preceding calendar year.

All of the numbers included here are still up for debate, as the Agency has yet to finalize a draft, but they give a general idea of the regulators’ current thinking.

The audits themselves must be very thorough and be carried out by a qualified and independent professional, though the auditor can be someone who works at the business. The exact nature of the audit will vary from business, based on factors such as the nature of its processing and the risk to consumers. The rules do suggest a number of safeguards that businesses should consider, including:

• Encryption
• Zero-trust architecture
• Account management & access controls
• Secure configuration of hardware & software
• Data retention schedules
• Vulnerability scans
• And more

In case businesses are thinking they may skate by without actually performing a cybersecurity audit because no one will know, the proposed rules require businesses to submit an annual certification stating that they have fulfilled their obligations.

Read the full proposed regulations on cybersecurity audits

Risk Assessments

tl;dr: Proposed rules would expand on the assessments already required by other states, both in what triggers the need for an assessment and the content of the assessments themselves.

Risk assessments are not new or unique to California; privacy laws from several other states such as Virginia, Connecticut, and Colorado already require businesses to carry out risk assessments in certain situations. Compliance experts have been waiting to see whether the scope of the risk assessments required in California would match closely to other states’ requirements, specifically those of Colorado, as it is the only other state to have provided much detail on this area of compliance.

Businesses may be somewhat disappointed to learn that the proposed rules are not identical to the requirements of other states. There is a longer list of processing activities that would trigger a risk assessment, and the assessments themselves also have several additional requirements not found in other states. That is to say, a business that has already performed a risk assessment according to Colorado’s rules may not be able to rely on that assessment meeting California’s new requirements. On the other hand, a risk assessment that meets California standards will likely satisfy the requirements of other states.

Here is proposed list of processing activities that would trigger the need for a risk assessment:

• Selling or sharing personal information
• Processing sensitive personal information (except in the case of employee data processed for normal employment purposes)
• Using automated decisionmaking technology in furtherance of a decision that results in the provision or denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment or contracting opportunities or compensation, healthcare services, or access to essential goods, services, or opportunities
• Processing the personal information of consumers that the business has actual knowledge are less than 16 years of age
• Using technology to monitor employees, independent contractors, job applicants, or students
• Processing the personal information of consumers in publicly accessible places using technology to monitor consumers’ behavior, location, movements, or actions
• Processing the personal information of consumers to train artificial intelligence or automated decisionmaking technology

As to the assessment itself, draft regulations go into some detail about what it must include:

• A short summary of the processing that presents significant risk to consumers’ privacy
• The categories of personal information to be processed and whether they include sensitive personal information
• The context of the processing activity, including the relationship between the business and the consumers whose personal information will be processed
• The consumers’ reasonable expectations concerning the purpose for processing their personal information, or the purpose’s compatibility with the context in which their personal information was collected
• The operational elements of the processing
• The benefits resulting from the processing to the business, the consumer, other stakeholders, and the public
• The negative impacts to consumers’ privacy associated with the processing
• The safeguards that the business plans to implement to address the negative impacts
• The business’s assessment of whether the negative impacts outweigh the benefits

The Agency has also proposed numerous additional requirements for assessments regarding automated decisionmaking technology and the training of AI.

Businesses will be required to annually submit abridged copies of their risk assessments to the Agency, along with a signed certification by an executive stating that the business has fulfilled its obligations.

Read the full proposed regulations on risk assessments

‍