California's Data Privacy Agency CPRA Rulemaking

In November 2020, California voters approved Proposition 24, also known as the California Privacy Rights Act ("CPRA"). The CPRA expands the consumer data privacy protections present in the more widely-known California Consumer Privacy Act ("CCPA"). Among other measures, the CPRA created the California Privacy Protection Agency (the "Agency"), which is tasked with CPRA rulemaking. The Agency recently put out a call for comments on particular topics that affect businesses that collect California resident consumer data.

What topics are in the CPRA rulemaking notice?

The Agency's notice contains several topics of interest concerning its initial rulemaking efforts, notably those that are not covered by existing CCPA regulations. Of particular note are rules surrounding automated decision making, Agency privacy audits, and responses to specific consumer requests for data information.