“CPRA will create the first agency in the US dedicated solely to privacy, similar to how EU member states have their own Data Protection Authorities, which could definitely up the ante for enterprises who had previously buried their head in the sand,” she tells Datanami via email. “The amendment also helps to clarify some of the discrepancies and clarifications from CCPA and puts in some interesting operationalization requirements for companies, like retention limits, minimization, audits and risk assessments for high risk processing, and more.”
One of the main practical challenges for enterprises moving forward, she says, will be ensuring that they have full awareness of their consumer’s data. This is particularly true when it comes to “sensitive personal information,” which is a newly defined term under CPRA.
