Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
CCPA Update with CPRA
A new president-elect wasn’t the only decision in California on November 3. Voters approved the California Rights and Enforcement Act of 2020 (CPRA), which amends the California Consumer Privacy Act (CCPA) that came into effect in January.
As a reminder, the CCPA is the Plymouth Rock of privacy protection in the United States. Other regions, like Europe, introduced the General Data Protection Regulation (GDPR) back in 2018. But the CCPA goes beyond protecting the privacy of citizens to also exposing economic relationships developed and fueled by their information. Like GDPR, CCPA provides a “right to know” why personal information is collected and how it is used and shared, a “right to delete” personal information and a “right to opt out” of the sales of their personal data with a protected “right to non-discrimination” when they exercise their CCPA rights.
California has also created a new oversight agency called the California Protection Agency to enforce consumer privacy protections. The newest act, CPRA, also triples the maximum penalties for privacy violations involving minors (consumers under 16) to $7,500 per violation.
The California Rights and Enforcement Act of 2020 (CPRA), which takes effect on January 1, 2023, amends and hardens the preceding CCPA act in the following ways:
Under the CPRA, any business that buys, sells or shares personal data of 100,000 consumers for business purposes is required to comply with the law. The old threshold, before CPRA, was 50,000 and included the sale of devices, which has now been eliminated. Note that the annual gross revenue of $25 million or 50 percent of annual revenues derived from the sale of consumer data remains the same.
With CPRA, consumers can request that businesses stop selling “sensitive personal information,” defined as any one of the following: social security number, account credentials and geolocation. It also protects more abstract information such as health, race, ethnicity, religion and memberships.
The CPRA expands the “right to opt out” beyond resale to include non-monetary transfers. Now, consumers can opt out from the sharing of their personal information, defined as disclosure or transfer to a third-party.
The CPRA expands the “right to know” from a 12-month limitation to beyond one year. And, the law also expands disclosure obligations to require businesses to notify consumers of the length of time they will retain personal information.
In addition to the amendments, CPRA adds a new “right of correction,” which provides a mechanism for consumers to correct inaccurate information. Businesses must now disclose this right and make “commercially reasonable” efforts to do so.
The CPRA doesn’t swing all to the consumer. The new law creates an exception to the “right to delete” allowing businesses to deny a request of the retention of personal data is “reasonably necessary and proportionate” and is adequately protected. Also, the CPRA extends employee and business-to-business exemptions until January 1, 2023.
Beyond the new rights and exemptions, the CCPA and CPRA duo demonstrate an overwhelming demand by consumers for their privacy and eliminate a carte blanche approach to the collection and dissemination of information. By implication, it means consumers expect that businesses will protect their data, not only from business operations, but from unauthorized access, transfer and resale. CPRA means businesses, while mapping data flow and resale, need to secure that entire pipeline from one end to the other.
Mark is a cybersecurity evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that legal firms integrate cybersecurity into their day-to-day operations.