CCPA 2.0 And The Changing Privacy Landscape, Part IV: Data Minimization & Retention

The fourth installment in our ongoing series about changes to the California Consumer Privacy Act (CCPA) focuses on the new data minimization and data retention requirements for subject businesses created by the passage of the California Privacy Rights Act (CPRA) on November 3, 2020. These provisions also obligate subject entities to implement business-wide internal policy changes to accommodate the possible need to change their data collection and retention policies before the CPRA is fully operative on January 1, 2023 (with a look-back period beginning January 1, 2022). As we know from the lead up to the CCPA's enforcement, these deadlines pass quickly.

Data Minimization

Businesses subject to the European Union's General Data Protection Regulation (GDPR) and other international data privacy laws will already be familiar with data minimization as a core tenet of data privacy. While not directly required under the CCPA, the CPRA amended Section 1798.100(c) of