Drafting Vendor Agreements to Comply With CPRA, CCPA, and GDPR Requirements: New Standard Clauses

Description

Recently, privacy laws have been enhanced by a number of laws in Europe and California, including the CPRA, CCPA, and GDPR. Companies must be aware of what this means for privacy regulation in California and beyond.

The majority of the CPRA's substantive provisions will take effect on Jan. 1, 2023, providing covered businesses with several months of valuable set-up time with the rulemaking process to begin during that same period. The CPRA's expansion of the "Right to Know" impacts personal information collected during the ramp-up period, on or after Jan. 1, 2022. Businesses must still comply with the CCPA and any regulations in the meantime.

Besides creating new criteria under which businesses are regulated and new categories of "sensitive personal information," the most powerful piece of this legislation is the creation of a new privacy enforcement authority. That authority shall have the ability to issue steep fines and restrict business activities of companies that fail to comply. Counsel should be prepared to review and revise policies to conform to the new and expanded consumer privacy rights.

The EU issued new Standard Contractual Clauses (SCCs) for the GDRP on June 4, 2021. The new SCCs address the compliance requirements for cross-border data transfers. The EU has established how the new SCCs resolve certain practical issues companies faced when using the older versions but simultaneously introduce new obligations for businesses that transfer personal data out of the EU.

Listen as our authoritative panel of attorneys clarifies the new CPRA requirements and best practices to begin modifying policies to ensure compliance.