What We Do
How we do it
Resources
SECURITY ADVISORIES
Nov 22, 2021
Microsoft Exchange Vulnerability - CVE-2021-42321
THE THREAT eSentire has identified publicly available Proof-of-Concept (PoC) exploit code, for the critical Microsoft Exchange vulnerability CVE-2021-42321. CVE-2021-42321 was announced as part of Microsoft’s November Patch Tuesday release. Exploitation would allow a remote threat actor, with previous authentication, to execute code on vulnerable servers. Prior to the patch release, Microsoft…
Read More
View all Advisories →
Company
ABOUT ESENTIRE
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
LATEST PRESS RELEASE
Oct 28, 2021
Telarus and eSentire Expand Partnership to Safeguard Enterprises Globally Against Business Disrupting Ransomware and Zero-Day Attacks
London, UK and Sydney, Australia– Oct. 28, 2021 - eSentire, recognized globally as the Authority in Managed Detection and Response (MDR), today announces the expansion of its partnership with Telarus, the largest privately-held distributor of business cloud infrastructure and contact centre services. Building on their mutual success across North America, Telarus will bring eSentire’s Managed…
Read More
Partners
PARTNER PROGRAM
Partners
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
PARTNER RESOURCES
Apply today to partner with the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Search
Resources
Blog — Nov 25, 2020

CCPA Plymouth Rock of Privacy Gets Hardened with the CPRA

CCPA Update with CPRA

Speak With A Security Expert Now

A new president-elect wasn’t the only decision in California on November 3. Voters approved the California Rights and Enforcement Act of 2020 (CPRA), which amends the California Consumer Privacy Act (CCPA) that came into effect in January.

What is CCPA?

As a reminder, the CCPA is the Plymouth Rock of privacy protection in the United States. Other regions, like Europe, introduced the General Data Protection Regulation (GDPR) back in 2018. But the CCPA goes beyond protecting the privacy of citizens to also exposing economic relationships developed and fueled by their information. Like GDPR, CCPA provides a “right to know” why personal information is collected and how it is used and shared, a “right to delete” personal information and a “right to opt out” of the sales of their personal data with a protected “right to non-discrimination” when they exercise their CCPA rights.

What is CPRA?

California has also created a new oversight agency called the California Protection Agency to enforce consumer privacy protections. The newest act, CPRA, also triples the maximum penalties for privacy violations involving minors (consumers under 16) to $7,500 per violation.

The California Rights and Enforcement Act of 2020 (CPRA), which takes effect on January 1, 2023, amends and hardens the preceding CCPA act in the following ways:

Higher inclusion thresholds with CPRA

Under the CPRA, any business that buys, sells or shares personal data of 100,000 consumers for business purposes is required to comply with the law. The old threshold, before CPRA, was 50,000 and included the sale of devices, which has now been eliminated. Note that the annual gross revenue of $25 million or 50 percent of annual revenues derived from the sale of consumer data remains the same.

CPRA brings expanded information definitions

With CPRA, consumers can request that businesses stop selling “sensitive personal information,” defined as any one of the following: social security number, account credentials and geolocation. It also protects more abstract information such as health, race, ethnicity, religion and memberships.

CPRA expands consumer rights

The CPRA expands the “right to opt out” beyond resale to include non-monetary transfers. Now, consumers can opt out from the sharing of their personal information, defined as disclosure or transfer to a third-party.

The CPRA expands the “right to know” from a 12-month limitation to beyond one year. And, the law also expands disclosure obligations to require businesses to notify consumers of the length of time they will retain personal information.

In addition to the amendments, CPRA adds a new “right of correction,” which provides a mechanism for consumers to correct inaccurate information. Businesses must now disclose this right and make “commercially reasonable” efforts to do so.

CPRA new exceptions and extensions

The CPRA doesn’t swing all to the consumer. The new law creates an exception to the “right to delete” allowing businesses to deny a request of the retention of personal data is “reasonably necessary and proportionate” and is adequately protected. Also, the CPRA extends employee and business-to-business exemptions until January 1, 2023.

CCPA and CPRA

Beyond the new rights and exemptions, the CCPA and CPRA duo demonstrate an overwhelming demand by consumers for their privacy and eliminate a carte blanche approach to the collection and dissemination of information. By implication, it means consumers expect that businesses will protect their data, not only from business operations, but from unauthorized access, transfer and resale. CPRA means businesses, while mapping data flow and resale, need to secure that entire pipeline from one end to the other.

View Most Recent Blogs
Mark Sangster
Mark Sangster Vice President and Industry Security Strategist

Mark is a cybersecurity evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that legal firms integrate cybersecurity into their day-to-day operations.