Apr. 4, 2023
California Privacy Agency Regulations Approved
The California Privacy Protection Agency released final regulations guiding the enforcement of the landmark California Consumer Privacy Act (CCPA). The rules are effective as of March 30, 2023, with enforcement set to begin on July 1, 2023.
What This Means: These rules update existing CCPA regulations to reflect the voter-approved Proposition 23, the California Privacy Rights Act (CPRA).
Industry Impact: The regulations focus on data processing agreements, consumer opt-out mechanisms, mandatory recognition of opt-out preferences, dark patterns and consumer request handling. Notably, the regulations include requirements on data minimization, meaning companies can only collect “necessary and proportionate” consumer data.
NMHC's Viewpoint: NMHC has long been engaged in tracking the CCPA and CPRA given their impact on multifamily operators within California and across the nation as the laws have been viewed by many as a de facto national standard. As the initial rulemakings surrounding CCPA implementation took place, NMHC filed comments to ensure California regulators understand the way apartment owners and operators use data, the robust needs for data to improve property operation and meet resident expectations as well as the high priority the apartment industry places on safeguarding of resident and business data.
What’s Next: CPPA is now beginning its next rulemaking process, which will focus on cybersecurity audits, risk assessments and automated decision-making.