Congratulations. You’re nearly to January 1 with new practices designed to address CCPA obligations. Hydrate, and grab an energy bar – you’re just hitting your stride. Up ahead, we’ll need to incorporate obligations under the final Attorney General CCPA regulations (finalized perhaps mid-summer?), potential new legislation, and perhaps changes from a ballot initiative, which just passed one of its own hurdles.

On December 17, Californians for Consumer Privacy – the organization led by Alastair Mactaggart that brought us the CCPA – announced that the Attorney General had released the title and summary for Initiative 19-0021, a/k/a CCPA 2.0.

The AG summary highlights that CCPA 2.0 would allow consumers to: (1) prevent businesses from sharing personal information; (2) correct inaccurate personal information; and (3) limit the use of certain types of “sensitive personal information.” The initiative would also prohibit retention of personal information for longer than reasonably necessary, triple the maximum penalties for violations of minors’ privacy rights, and establish a new California Privacy Protection Agency, with the ability to impose fines. The summary also notes that the initiative could cost the state over $10MM, and it remains unknown how the initiative would affect state revenue associated with taxes from businesses affected by the initiative.

Californians for Consumer Privacy will have 180 days to gather at least 623,212 signatures (based on 5% of the total votes cast in the last gubernatorial election) to get the initiative on the November ballot. For reference, the group had obtained 629,000 signatures by June 2018 for CCPA 1.0.

Businesses and privacy professionals would do well to catch their breath over the holiday season. Next year is going to need focus and investment to reach the finish line (which, yes, will continue to move because this is privacy law, after all).

CCPA Marathon: January 1 Might Be the Midway Point