What We Do
How we do it
Resources
TRU INTELLIGENCE CENTER
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
View Threat Intelligence Resources →
SECURITY ADVISORIES
Jun 01, 2023
Critical Vulnerability in MOVEit Transfer
THE THREAT eSentire is aware of reports relating to the active exploitation of a currently unnamed vulnerability impacting Progress Software’s managed file transfer software MOVEit Transfer.…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Mar 20, 2023
Exertis and eSentire Partner to Deliver 24/7 Multi-Signal MDR, Digital Forensics & IR Services and Exposure Management to Organisations Across the UK, Ireland, and Europe
Basingstoke, UK– 20 March, 2023. Leading technology distributor, Exertis, announced today that it has bolstered its cybersecurity services, adding eSentire, the Authority in Managed Detection and Response (MDR), to its Enterprise portfolio of offerings. eSentire’s award-winning, 24/7 multi-signal MDR, Digital Forensics & Incident Response (IR), and Exposure Management services will be available…
Read More
Partners
PARTNER PROGRAM
e3 Ecosystem
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Learn more
ECOSYSTEM PARTNER RESOURCES
Apply to become an e3 ecosystem partner with eSentire, the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Nov 25, 2020

CCPA Plymouth Rock of Privacy Gets Hardened with the CPRA

CCPA Update with CPRA

2 minutes read
Speak With A Security Expert Now

A new president-elect wasn’t the only decision in California on November 3. Voters approved the California Rights and Enforcement Act of 2020 (CPRA), which amends the California Consumer Privacy Act (CCPA) that came into effect in January.

What is CCPA?

As a reminder, the CCPA is the Plymouth Rock of privacy protection in the United States. Other regions, like Europe, introduced the General Data Protection Regulation (GDPR) back in 2018. But the CCPA goes beyond protecting the privacy of citizens to also exposing economic relationships developed and fueled by their information. Like GDPR, CCPA provides a “right to know” why personal information is collected and how it is used and shared, a “right to delete” personal information and a “right to opt out” of the sales of their personal data with a protected “right to non-discrimination” when they exercise their CCPA rights.

What is CPRA?

California has also created a new oversight agency called the California Protection Agency to enforce consumer privacy protections. The newest act, CPRA, also triples the maximum penalties for privacy violations involving minors (consumers under 16) to $7,500 per violation.

The California Rights and Enforcement Act of 2020 (CPRA), which takes effect on January 1, 2023, amends and hardens the preceding CCPA act in the following ways:

Higher inclusion thresholds with CPRA

Under the CPRA, any business that buys, sells or shares personal data of 100,000 consumers for business purposes is required to comply with the law. The old threshold, before CPRA, was 50,000 and included the sale of devices, which has now been eliminated. Note that the annual gross revenue of $25 million or 50 percent of annual revenues derived from the sale of consumer data remains the same.

CPRA brings expanded information definitions

With CPRA, consumers can request that businesses stop selling “sensitive personal information,” defined as any one of the following: social security number, account credentials and geolocation. It also protects more abstract information such as health, race, ethnicity, religion and memberships.

CPRA expands consumer rights

The CPRA expands the “right to opt out” beyond resale to include non-monetary transfers. Now, consumers can opt out from the sharing of their personal information, defined as disclosure or transfer to a third-party.

The CPRA expands the “right to know” from a 12-month limitation to beyond one year. And, the law also expands disclosure obligations to require businesses to notify consumers of the length of time they will retain personal information.

In addition to the amendments, CPRA adds a new “right of correction,” which provides a mechanism for consumers to correct inaccurate information. Businesses must now disclose this right and make “commercially reasonable” efforts to do so.

CPRA new exceptions and extensions

The CPRA doesn’t swing all to the consumer. The new law creates an exception to the “right to delete” allowing businesses to deny a request of the retention of personal data is “reasonably necessary and proportionate” and is adequately protected. Also, the CPRA extends employee and business-to-business exemptions until January 1, 2023.

CCPA and CPRA

Beyond the new rights and exemptions, the CCPA and CPRA duo demonstrate an overwhelming demand by consumers for their privacy and eliminate a carte blanche approach to the collection and dissemination of information. By implication, it means consumers expect that businesses will protect their data, not only from business operations, but from unauthorized access, transfer and resale. CPRA means businesses, while mapping data flow and resale, need to secure that entire pipeline from one end to the other.

View Most Recent Blogs
eSentire
eSentire

eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks. For more information, visit: www.esentire.com and follow @eSentire.