Cybersecurity Policy Report, CCIA Sends Comments on Proposed CPRA Rulemaking, (Aug 18, 2022)
Organizations Mentioned:Computer & Communications Industry Association
By Tony Foley
The Computer & Communications Industry Association (CCIA) announced today that that it had filed comments with the California Privacy Protection Agency (CPPA) in response to the agency's request for information on proposed rules designed to implement the California Privacy Rights Act (CPRA).
In its 19-page submission, the CCIA reiterated its longstanding support of the evolution of privacy policy to keep pace with evolving technologies. It calls the proposed regulations "an impressively comprehensive set of protections [that] are, by far, the most developed guidelines in the nation."
The CCIA's comments focus on areas of the proposed regulations that it says warrant revision by the CPPA to ensure that they reflect the mandates as set forth in the CPRA, are feasible to implement in a timely fashion, allow for flexibility to avoid inhibiting innovation, and prevent unintended retroactive application. Specifically, the comments address the following issues:
Consent and opt-out preference signals: The CCIA asserts that several proposals regarding consents and opt-outs exceed the mandates provided in the CPRA;
Third-party service providers and contractors. The comments contend that the proposed rule improperly converts third parties into primary actors under CPRA and that they should be revised to avoid onerous or duplicative compliance burdens;
Consumer rights. The CCIA suggests a variety of modifications in this area, including avoiding the adoption of an "average consumer" standard in deciding what constitutes "reasonable, necessary and proportionate" collection and use, and broadening illustrative examples regarding data minimization, among other recommendations; and
Dark patterns. The CCIA argues that the CPPA should adopt the FTC's approach to dark patterns, which focus on eliminating practices that are harmful rather than prescribing specific design practices that will limit innovation and design creativity.
"We appreciate the opportunity to offer additional input as California adopts regulations to implement these privacy protections," said CCIA State Policy Director Khara Boender. "It will be important as these rules are implemented that businesses have flexibility on various details like how they comply with provisions to notify third parties of consumers' preferences so as not to inhibit new tech features and innovation."
News: StateLegislation DataPrivacy