The California Privacy Protection Agency (“CPPA”) discussed at its July 16 meeting new enforcement focuses in addition to current goals.  While the new focuses are largely in line with general trends, they also serve as a reminder that specific and nuanced compliance decisions can make a big difference.

As the CPPA has made clear in multiple statements, its focus over the past year has largely been on monitoring privacy notices and policies, the right of deletion, and the handling and implementation of consumer requests.  For example, the CPPA issued a formal enforcement advisory in April emphasizing that businesses must not request unnecessary personal information when consumers opt out of data sales.

The discussion at the July 16 meeting continues this trend, but adds four new focus areas including dark patterns, honoring consumer opt-out requests, providing proper notice of information sales and sharing, and the agency’s prioritization of cases that affect vulnerable groups.

The CPPA notes that investigations typically span about 18 months and are ongoing across a variety of sectors, encouraging businesses to continue to be proactive in their privacy compliance efforts.  The agency hopes to continue issuing enforcement advisories as they collaborate with other states and federal partners in addressing privacy issues.

Additionally, the agency is considering new draft regulations that would address a variety of privacy issues, including privacy rights around automated technology and artificial intelligence (“AI”).  These regulations include increased audit requirements and rules guiding companies on using AI in their businesses. These proposals will be closely watched as they may impact common practices – including relating to employee monitoring.

In other words, although the state legislative season has ended for the year, the privacy compliance landscape continues to evolve.

[View source.]