The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) are two pieces of legislation designed to enhance San Francisco privacy rights and consumer protection for residents of San Francisco. Here’s a breakdown of the key rights these laws grant to California consumers:
California Consumer Privacy Act (CCPA)
- Right to Know: San Francisco consumers have the right to know what personal information is being collected about them, the purpose of its collection, and to whom it is being disclosed.
- Right to Delete: San Francisco consumers can request the deletion of their personal information held by businesses.
- Right to Opt-Out: San Francisco consumers can opt out of the sale of their personal information by a business to third parties.
- Right to Non-Discrimination: San Francisco businesses cannot discriminate against San Francisco consumers for exercising their CCPA rights, such as by charging different prices or providing a different quality of goods or services.
California Privacy Rights Act (CPRA)
The CPRA, often seen as an extension and expansion of the CCPA, introduced additional rights and modifications:
- Right to Correction: San Francisco consumers have the right to correct inaccurate personal information held by businesses.
- Right to Limit Use and Disclosure of Sensitive Personal Information: San Francisco consumers can direct businesses to limit the use of their sensitive personal information (such as health, financial, or precise geolocation data) to that which is necessary to perform the services or provide the goods requested by the consumer.
- Right to Know: Expanded from CCPA, this includes the right to know the length of time the business intends to retain each category of personal information, or if that is not possible, the criteria used to determine such period.
- Risk Assessment and Cybersecurity Audits: San Francisco businesses are required to perform regular risk assessments and cybersecurity audits for processing that presents a significant risk to consumer privacy.
- Establishment of the California Privacy Protection Agency (CPPA): The CPRA established the CPPA, which is responsible for implementing and enforcing the CCPA and CPRA.
These rights apply to San Francisco residents and cover personal information that businesses collect, sell, or share. Businesses subject to the CCPA and CPRA include those with gross annual revenues over $25 million, those that buy, sell, or share the personal information of 100,000 or more San Francisco residents or households, or those that derive 50% or more of their annual revenue from selling or sharing San Francisco residents’ personal information. It’s important for both San Francisco consumers and businesses to understand these laws to ensure compliance and protect consumer privacy rights. For the most accurate and detailed information, consulting the actual text of the CCPA and CPRA or legal advisories is recommended, as these laws also include certain exceptions and specific conditions.
