California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CCPRA) Updates

Bookmark this page (Ctrl+D): Return for Ongoing Updates

The California Privacy Protection Agency is the first dedicated U.S. privacy regulator and is tasked with enforcement of both CPRA and CCPA. CCPA and CPRA provide consumers certain rights regarding their personal information including:

The right to delete personal information collected from them;
The right to know what personal information a business has collected about them and how it is used and shared;
The right to opt-out of the sale and sharing of their personal information; and
The right to non-discrimination for exercising their CCPA rights;
The right to correct inaccurate personal information that a business has about them; and
The right to limit the use and disclosure of sensitive personal information collected about them.

In the course of doing business, rental housing owners and operators, and their third-party service providers, collect, use and maintain a significant amount of highly sensitive personal data about applicants, residents and employees. As such, NMHC has long been engaged in tracking the CCPA and CPRA given their impact on multifamily operators within California and across the nation as the laws have been viewed by many as a de facto national standard.

Read on for the latest updates on this topic.

Learn more about NMHC’s broader efforts on this issue by checking out our federal legislative updates on data privacy.

Apr. 4, 2023

📄

California Privacy Agency Regulations Approved

The California Privacy Protection Agency released final regulations guiding the enforcement of the landmark California Consumer Privacy Act (CCPA). The rules are effective as of March 30, 2023, with enforcement set to begin on July 1, 2023.

What This Means: These rules update existing CCPA regulations to reflect the voter-approved Proposition 23, the California Privacy Rights Act (CPRA).

Industry Impact: The regulations focus on data processing agreements, consumer opt-out mechanisms, mandatory recognition of opt-out preferences, dark patterns and consumer request handling. Notably, the regulations include requirements on data minimization, meaning companies can only collect “necessary and proportionate” consumer data.

NMHC's Viewpoint: NMHC has long been engaged in tracking the CCPA and CPRA given their impact on multifamily operators within California and across the nation as the laws have been viewed by many as a de facto national standard. As the initial rulemakings surrounding CCPA implementation took place, NMHC filed comments to ensure California regulators understand the way apartment owners and operators use data, the robust needs for data to improve property operation and meet resident expectations as well as the high priority the apartment industry places on safeguarding of resident and business data.

What’s Next: CPPA is now beginning its next rulemaking process, which will focus on cybersecurity audits, risk assessments and automated decision-making.

Nov. 6, 2020

📄

California Votes to Expand CCPA

California Prop. 24, otherwise known as the California Privacy Rights Act (CPRA), was approved by California voters during this week’s election.

What This Means: CPRA is a further expansion of consumer privacy rights included in the California Consumer Privacy Act (CCPA) and moves California data privacy regulations closer to the more stringent European Union General Data Protection Regulation (GDPR) standards.

Industry Impact: CPRA is designed to give consumers more data privacy rights, with a particular focus on data sharing and behavioral advertising. It also amends certain provisions of the landmark CCPA and introduces new provisions that will need to be clarified through the rulemaking process. CPRA’s reach will be established through a new California Privacy Protection Agency, which will enforce the law alongside the state attorney general and will go into effect January 2023.

What's Next: It’s important to note that during the rulemaking process and before CPRA goes into effect, the CCPA stands and will be enforced. As we have covered extensively in the past, many apartment firms and American businesses operating in California had to begin complying with CCPA on January 1, 2020, though long-awaited  final regulations were not released until August 14, 2020. While the impact of CPRA on apartment firms has not yet been made clear, in the short term, the CPRA extends the CCPA employee data protection provisions exemption for employers, set to end on January 1, 2021.

Learn More: Manatt, the legal experts who wrote NMHC’s industry white paper on data privacy and protection, have provided a helpful analysis/backgrounder on CPRA and where it expands on the CCPA, which can be found here.

Aug. 28, 2020

📄

California Data Privacy Regulations Finalized, California Privacy Rights Act Heads to Ballot

California Attorney General Xavier Becerra released long-awaited final regulations for the California Consumer Privacy Act (CCPA) on August 14, 2020, that went into effect immediately. The Office of the Attorney General can now fully implement and enforce CCPA, along with these final regulations.

In addition to CCPA compliance, firms conducting business in California should be aware of other data privacy activity. As of January 1, 2021, employment-related data and business to business data will no longer be exempted from CCPA. Additionally, Proposition 24, known as the California Privacy Rights Act, will be on the November ballot in California and could impact apartment firms.

What This Means: Apartment firms and other organizations that operate in California have been challenged by the process because they were required to comply with CCPA as of January 1, 2020, even as they waited for the rulemaking process to end. There are some notable changes from previous versions of the proposed regulations, including regarding non-disclosed uses of personal information, authorized agents and opt-out requests. NMHC encourages apartments firms to consult counsel on applicability and compliance

What's Next: NMHC and the apartment industry continue to monitor data privacy legislation and had notable successes during the CCPA rulemaking process. After NMHC filed comments on the proposed CCPA regulations, California Attorney General Becerra made some changes to the regulations that address the industry’s concerns.

Feb.20,2020

📄

California Issues Updated Proposed Rules on Privacy

California Attorney General Xavier Becerra issued updated proposed regulations that lay the groundwork for fully implementing and enforcing the California Consumer Privacy Act (CCPA). 

What This Means: The update comes on the heels of over 200 public comments being submitted to the state in December as companies and industries of all types readied compliance with the CCPA, which officially took effect on January 1, 2020. NMHC and NAA both submitted comments seeking changes and clarifications to be made to the underlying regulations.

Industry Impact: The Attorney General’s update incorporates some, but not all, of the industry’s requests ensuring that compliance with the CCPA will remain a challenge. One substantial area that the Attorney General ultimately agreed with NMHC members, and then put forward industry-submitted language, is in how requests to access or deletion of household information is handled. Apartment owners and operators rightly pointed out concerns with potential troublesome circumstances emerging from ex-roommates or ex-partners becoming privy to private information by having the “household right” to know or delete personal information on all members of that household. In agreeing with the industry, the Attorney General now says a business should not delete personal data or respond to a “Right to Know” request unless a household has a password-protected account or each member of the household signs onto the request.

NMHC's Viewpoint: NMHC filed comments highlighting the unique complexities of compliance for the industry and noting the unintended new risks that CCPA created on the privacy and security of consumer data. NMHC argued that those challenges can be addressed through clarifications and amendments to the Proposed Regulations.

What’s Next: NMHC and NAA are continuing to review the new proposed regulations and consulting with apartment owners, operators and suppliers in anticipation of additional comments due February 25. Because of the complexity of businesses complying with a growing patchwork of data breach notification, security and now privacy standards across the country, NMHC and NAA are actively supporting a federal data security and privacy standard. A number of pieces of legislation have been introduced in Congress throughout 2019 and into 2020 yet definitive action remains uncertain at this time.

Kevin Donnelly kdonnelly@nmhc.org

Julianne Goodfellow jgoodfellow@nmhc.org

Daria Dudzinski ddudzinski@nmhc.org