Temporarily lost amid the ongoing battle for the White House were some measures and developments in other areas that have the potential to impact the accounts receivable management industry. Voters in California, for example, approved a ballot initiative known as Proposition 24, or the California Privacy Rights Act of 2020. It is a companion law to the California Consumer Privacy Act, and includes a number of provisions regarding how companies store and use data about consumers.
The new law is not scheduled to go into effect until 2023, but some provisions related to how personal information is collected will start applying to businesses in 2022. It will also create a new state agency in California, the California Privacy Protection Agency, which will have the right to audit companies to ensure compliance with the laws as well as be responsible for further regulation and enforcement. This agency will be the first agency in the country dedicated solely to consumer privacy.
Under the provisions of the CPRA, businesses would be required to:
- not share a consumer’s personal information upon the consumer’s request;
- provide consumers with an opt-out option for having their sensitive personal information, as defined in law, used or disclosed for advertising or marketing;
- obtain permission before collecting data from consumers who are younger than 16;
- obtain permission from a parent or guardian before collecting data from consumers who are younger than 13; and
- correct a consumer’s inaccurate personal information upon the consumer’s request.
Consumers will have the right to direct businesses to limit its use and disclosure of data to that “which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such goods or services” and must offer a link on their homepages to give consumers the opportunity to do so.
The CPRA also seeks to settle the debate over the CCPA’s definition of “sale” of data and creates a new category, called “sharing.” Consumers will have to be provided the opportunity to opt out of their data being shared as it pertains to behavioral advertising and defines sharing as making a consumer’s data available to a third party.
The CPRA also imposes new restrictions on service providers and contractors, and includes provisions that must be included in written contracts between businesses and their vendors.
