Recently, we blogged concerning the California State Attorney
General's release of draft California Consumer Privacy Act ("CCPA")
regulations and the associated request for public comment. In
that blog, we highlighted that new obligations had
been added that were not included in the CCPA itself. Today, we
discuss one such new provision – Section 999.317(g) of the
proposed CCPA regulations, which creates new record-keeping and
disclosure obligations for every business that "alone or in
combination, annually buys, receives for the business's
commercial purposes, sells, or shares for commercial purposes, the
personal information of 4,000,000 or more consumers."
What are the new disclosure and record-keeping
requirements contained in Section 999.317(g)?
