The California Legislature Considers Additional Amendments to the CCPA, Including Exemption of Information Pertaining to Public Health Activities

The California Legislature considers additional amendments to the California Consumer Privacy Act (CCPA).   The proposed amendments are currently pending in the legislative committees.

California AB 713 proposes exceptions to the CCPA for HIPAA de-identified information and other health and research data.   The proposed amendment would exempt from the CCPA information de-identified in accordance with the HIPAA requirements if the information is derived from the certain protected health and medical information and the business does not attempt to reidentify nor actually reidentifies the information.   As noted in one of the commentaries, this proposal is intended to address potential inconsistencies between the HIPAA and the CCPA de-identification standards and could be available to research institutions and life science companies which process the protected medical information but are not themselves subject to the HIPAA.

The amendment would also exempt from the CCPA HIPAA business associates to the extent that they maintain, use, or disclose patient information in accordance with the HIPAA requirements, even if the information itself does not fall within the scope of the HIPAA.  The amendment would further exempt certain personal information used for public health and safety, such as product registration and tracking consistent with the FDA regulations, public health activities described in the HIPAA Regulations, 45 CFR § 164.512, and activities related to quality, safety, and effectiveness regulated by the FDA.  These exempt categories would still remain subject to certain CCPA requirements, such as notice and access, as well as private right of action provisions.

An exemption for information pertaining to public health activities, such as disclosures to public health authorities collecting information to control the spread of a decease or conducting public health surveillance would be particularly timely as public health authorities are likely to begin collection and processing  of geolocation and smartphone movement data to battle the coronavirus pandemic.

California SB 1022,  another proposed amendment, would amend the CCPA to provide that a consumer’s election to opt out of the sale of personal information about the consumer would remain effective after the entity that holds the information, or the information itself, is sold.

We will continue to follow the legislative developments related to the CCPA and report them in our blog.

Ask Clarip today how we can solve your biggest compliance pain points, Call Clarip at 1-888-252-5653