Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

In just the first few months of this year we already have seen significant state law developments that raise the privacy compliance stakes, including five new state privacy statutes, and the pace of change continues to accelerate. California and Colorado both have adopted final regulations that implement their respective comprehensive consumer privacy legislation. The new regulations fill in areas left open in the statutes and, in some instances, actually add to the compliance burden. The key issues that impact evolving organizational privacy compliance obligations include:

contentpilot/introduction

core/heading

The California Privacy Rights Act (CPRA), which significantly amended the California Consumer Privacy Act (CCPA), went into effect on January 1. Under the CPRA, the California Privacy Protection Agency (CPPA) is tasked with adopting regulations to implement the CPRA. On February 3, after several rounds of rulemaking activity including extensive public comments, the CPPA adopted and approved its first rulemaking package. On March 30 the CPPA announced the California Office of Administrative Law had approved the regulations, which took effect immediately upon publication. The approved CCPA regulations include:

core/paragraph

core/list

With its first major rulemaking agenda completed, the CPPA’s rulemaking activity continues. Seven days after approving the first set of regulations summarized above, on February 10, the agency issued an invitation for preliminary comments on cybersecurity audits, risk assessments and automated decision-making, issues that are not covered in the recently approved regulations.

On March 15 the Colorado Attorney General’s Office filed final rules with the Secretary of State implementing the Colorado Privacy Act (CPA) enacted in 2021. The new regulations provide guidance ahead of the CPA’s July 1 effective date.

The CPA regulations include provisions specific to data protection assessments and profiling, similar to those now being considered by the CPPA. Major provisions of the CPA regulations include:

California’s and Colorado’s new privacy regulations provide important guidance to help companies bolster their compliance activities mandated in the 2023 calendar year. Common provisions across these two state privacy laws may ease the challenge of meeting state compliance but the differences will require adaptive approaches and guidance from counsel to ensure businesses are current on their privacy obligations.

<em>This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.</em>

<em>This document may be considered attorney advertising in some jurisdictions.</em>

https://admin.thompsonhine.com/wp-content/uploads/2023/04/Privacy-Cybersecurity-Update-California-and-Colorado-Finalize-Privacy-Regulations.pdf

California and Colorado Finalize Privacy Regulations

Services