Privacy update: CCPA/CPRA regulations finalized

A description that is too granular, loosely worded or inconsistent with public-facing privacy disclosures can invite scrutiny or create ammunition for plaintiffs’ counsel. In practice, most companies of scale will trigger risk assessment requirements across multiple processing activities. The underlying audit report is not submitted to the CPPA and, under the regulations, can https://fu-fu-nikki.com/2020/12/page/3/ be obtained only through compulsory process. By contrast, the cybersecurity audit submissions consist of an attestation and certifying officer contact details.

Internal or external auditors may conduct the audit, but must follow generally accepted auditing standards, such as those provided by the American Institute of Certified Public Accountants or Public Company Accountability Oversight Board. By April 1 of each year, businesses must submit a certification to the CPPA that it has completed https://investnews24.net/how-to-choose-a-cloud-service-for-data-storage.html its cybersecurity audit which must be signed by a member of the business’s executive management team attesting to responsibility for its content and to the report’s accuracy. The Audit requirement does not apply to all businesses subject to the CCPA, but only those that meet certain thresholds.

One underappreciated feature of the risk assessment regulations is that a single assessment can cover a comparable set of similar processing activities and be updated as those activities evolve. The certified submission is a separate document from the underlying report, and it requires its own care. This approach is designed to protect candid internal analysis — including gap identification — from becoming a roadmap for plaintiffs or regulators in subsequent proceedings, to the extent those protections apply. For cybersecurity audits, early engagement also helps coordinate technical vendors, whose capacity may be limited, under an appropriate legal structure from the outset. Outside counsel can structure the engagement to support applicable attorney-client privilege and work-product protections, recognizing that the availability of those protections will depend on the facts and governing law. The regulatory settlement was only part of the exposure.

Establishing appropriate purposes and objectives for conducting the risk assessment

For assessments conducted after 2027, the submission is due by April 1 of the following year. For assessments https://www.downloadwasp.com/list.php?cat=Business%3A%3AVertical%20Market%20Apps&page=9 conducted in 2026 and 2027, the submission is due by April 1, 2028. Risk assessments must involve relevant stakeholders whose duties include the processing activity that necessitated the risk assessment.

Scope of Application

Businesses required to conduct a cybersecurity audit must annually certify to the CPPA that it has completed its cybersecurity audit. In performing the audit, auditors must operate independently and rely on their own analyses of the relevant security testing and information provided in making their assessment. The updated regulations also elucidate requirements on performing annual cybersecurity audits for businesses whose processing of personal information presents a “significant risk” to consumers’ security. This memorandum is considered advertising under applicable state laws.

• Companies that begin early retain the ability to fix what they find before anything is submitted.
• For the cybersecurity audit, counsel coordinates the attestation and ensures the certifying officer is appropriately identified and prepared.
• Businesses will be well served by staying abreast of enforcement trends and future regulatory developments.
• Other narrow exceptions apply to certain hiring, admissions, and work allocation decisions, but only when the ADMT is used solely for assessing the consumer’s ability to perform and the ADMT demonstrably works for its purpose and does not unlawfully discriminate.3.
• For the risk assessment, counsel structures the submission to accurately present the company’s program without volunteering detail that invites unnecessary scrutiny.
• Businesses may utilize risk assessments prepared for another purpose, provided that the risk assessment contains the required information, or is supplemented with the outstanding information necessary for complying with the new regulations.

This memorandum is provided by Skadden, Arps, Slate, Meagher & Flom LLP and its affiliates for educational and informational purposes only and is not intended and should not be construed as legal advice. Proactive remediation is the single most significant factor in limiting enforcement exposure. Companies that wait may have no time to remediate before they must disclose.

• Businesses should ensure their risk assessment documentation is complete and organized for potential production on short notice.
• A business may also use a risk assessment prepared for another purpose or to comply with another law, such as a General Data Protection Regulation (GDPR) data protection impact assessment, if it contains, or is supplemented to contain, the information required by Section 7152.
• For preexisting activities, the deadline to complete assessments is December 31, 2027, meaning businesses should be cataloging their processing activities and beginning documentation now.
• The submission requirement covers summary information and attestations only; the full risk assessment report is not submitted unless separately requested by the CPPA.
• Any CCPA-covered business whose processing presents significant risk to consumers’ privacy must conduct and document a risk assessment before initiating that processing.
• The submission must be completed by an executive management team member who is directly responsible for the business’s risk assessment compliance, has sufficient knowledge of the business’s risk assessments to provide accurate information, and has authority to submit the risk assessment information to the CPPA.

The risk assessment report itself is subject to regulatory request. The risk assessment submission requires a company to describe its qualifying processing activities and the categories of personal information involved. These submissions are not merely administrative. Although the deadlines and submissions differ, both require planning now because the covered activity periods begin well before the first filings are due.

Among other types of processing of personal information, the use of ADMT for Significant Decisions triggers a mandatory risk assessment requirement, which is discussed below. One exception is the alternative decision-making process where the business offers an appeal process that is conducted by a human reviewer with the authority to overturn the decision. Businesses must provide consumers the right to opt out of ADMT used for Significant Decisions.

• Previously, the CCPA required businesses to maintain reasonable security procedures but stopped short of mandating formal cybersecurity audits, audit certifications, risk assessments, or submissions.
• The audit must assess whether the business’s cybersecurity program protects personal information from unauthorized access, destruction, use, modification, or disclosure and whether the program is appropriate to the size, complexity, nature, and scope of the business’s processing activities.
• Businesses should review vendor agreements now and, where necessary, add cooperation obligations before the first audit period begins.
• Risk assessments for preexisting high-risk processing must be completed by December 31, 2027.

The Pre-Use Notice can be incorporated into the business’s CCPA notice at collection and can also be consolidated for multiple ADMTs used for a single or multiple purposes.2. Under the CCPA, ADMT means “any technology that processes personal information and uses computation to replace human decision-making or substantially replace human decision-making.” A decision is “substantially” replacing human involvement if the output is used to make a decision without meaningful human review. Businesses must also amend their service provider agreements to require their service providers to assist them in completing their cybersecurity audits, risk assessments, and complying with the new ADMT requirements. Notably, the CPPA notes the goal of a risk assessment is to restrict or prohibit the “processing of personal information if the risk to the consumer’s privacy outweigh the benefits resulting from the processing.” Thus, businesses must carefully weigh whether to proceed in processing activities that present significant risk to consumers’ privacy.