California Finalizes New CCPA Rules On ADMT, Cybersecurity Audits, And Risk Assessments

On July 24, the California Privacy Protection Agency (CPPA) approved a major rule package covering automated decision-making technology (ADMT), mandatory cybersecurity audits, and privacy risk assessments under the California Consumer Privacy Act (CCPA). The package narrows the definition of ADMT to tools that replace human decision making for significant decisions in areas like lending, housing, employment, education, and health care.

For financial institutions, the rules impose new requirements on ADMT used in lending and employment, as well as mandatory cybersecurity audits and risk assessments tied to data processing activities. The package also includes targeted updates to existing CCPA regulations.