California Finalizes Rules On Automated Decisionmaking, Risk Assessments & Cybersecurity Audits

This week, the California Privacy Protection Agency (CPPA) announced the approval of new regulations on automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits. The rulemaking package also includes regulations concerning insurance companies and revisions to existing CPPA regulations.

The rules will have widespread effects for businesses around the world by mandating, for example, documentation of risk analyses before using personal information for new high-risk uses, opt-outs and appeals of major artificial intelligence (AI)-based decisions, and annual independent security audits that are certified to the Agency. The much-anticipated final regulations come after a years-long process involving substantial industry and public input and several rounds of revisions that culminated with final approval by the CPPA Board and the California Office of Administrative Law.