Timeline

Below are some of the key dates associated with the California Privacy Rights Act (CPRA) of 2020:

Under Article II, Section 10(a) of the California Constitution, the measure becomes effective five days later, or December 16, 2020. However, with several exceptions described below, the measure becomes operative on January 1, 2023. See Section 31. The following provisions become operative on December 16, 2020:

• “Employer – Employee exemption” [Section 1798.145(m) and (n)]
  • information collected by businesses about their employees; and information reflecting written or verbal communications or transactions between an employee and their employer or another business, are not subject to CCPA, except for Section 1798.100 (notification) and Section 1798.150 (data breach). Exemption sunsets 1/1/23 (previously expired 1/1/22) [Section 1798.145(m)(4) and (n)(3).
  • first offset costs of courts and AG
  • then 91% into a lockbox fund, interest available for general fund; 9% to consumer advocates & law enforcement

  [within 90 days of effective date] [See Section 1798.199.10(b)].

  • Note that Attorney General civil enforcement of CCPA/CPRA continues indefinitely; agency commences administrative enforcement starting 7/1/23].

  i.e. as long as the business keeps the information [Section 31(a)]. Prior to this date, the business is only required to provide the most recent 12 months of personal information collected by the business, to the requesting consumer; after this date, a consumer may request all their information collected by the business, in the possession of the business, going back to 1/1/22.