On November 3, the California Privacy Rights and Enforcement Act
("CPRA") was voted into law with
close to 56 percent of California voters supporting the measure.
The CPRA is the latest comprehensive privacy law to pass in
California and it significantly amends the currently effective
California Consumer Privacy Act (CCPA). Among other things, the
CPRA creates additional obligations for companies collecting and
sharing "sensitive" personal information, as well as a
new agency, the California Privacy Protection Agency, that will be
responsible for enforcing violations of the new law. We have
previously written about the CPRA and its requirements here.
The substantive requirements for businesses subject to the CPRA
do not go into effect until January 1, 2023, and these provisions
are not enforceable until July 1, 2023. Additionally, most of these
substantive requirements (with the exception of the "Right to
Know" obligations) only apply to personal information
