DPO Advisor

International cosmetics retailer Sephora has become the first company to be penalized under the California Consumer Privacy Act (CCPA). The cosmetics has agreed to pay $1.2M to settle allegations. California Attorney General Rob Bonta alleged that Sephora failed to: disclose to consumers that it was selling their personal informationprocess user requests to opt-out of sale via user-enabled global privacy controls in violation of the CCPAand that it did not cure these violations within the 30 days currently allowed by the CCPAIn addition to the $1.2M fine, the retailer must also: Clarify its online disclosures and privacy policy to include an affirmative representation that it sells data;Provide mechanisms for consumers to opt-out of the sale of personal information, including via the Global Privacy Control; Conform its service provider agreements to the CCPA’s requirements; and Provide reports to the Attorney General relating to its sale of personal information, the status of its service provider relationships, and its efforts to honor Global Privacy Control. ‍

In late May, 2022, the California Privacy Protection Agency (CPPA) released a draft for the California Privacy Rights Act (CPRA). The draft covered only a few of the 22 regulatory topics the CPPA set out to address, including personal data collection & processing restrictions, privacy notice requirements, and more. On June 8, the Agency held a board meeting, discussed proposed regulations, and reached “an incredible milestone”, voting to begin the CPRA rule-making process.

The CCPA requires businesses over a certain threshold to disclose certain metrics about their CCPA compliance by July 1. These reporting obligations apply to any business that is subject to the CCPA and “knows or reasonably should know that it, alone or in combination, buys, receives for the business’s commercial purposes, sells...