United States of America: Opened second consultation on modified draft CPRA Regulations

On 3 November 2022, the California Privacy Protection Agency (CPPA) opened a second public consultation on the revised version of the California Privacy Rights Act Regulations (CPRA Regulations) until 21 November 2022. The revised CPRA Regulations outline further clarification on collecting or processing personal information, including the specificity and clarity of disclosures to consumers. The entities collecting data will be required to ensure that disclosed purpose is compatible with the context in which the personal information was collected. The revised CPRA Regulations state that businesses do not need to give notice of the right to limit sensitive personal information use if the business does not collect the information for consumer profiling. Further, it specifies that the purpose of collection or processing must be consistent with the consumer's "reasonable expectations". The revised CPRA Regulations also set requirements for third parties collecting personal information to provide a collection notice. Further, it regulates the concept of "disproportionate efforts", limiting the obligation to respond to user rights requests in cases of disproportionate effort.