The California Privacy Rights Act (CPRA) amends the California Consumer Privacy Act (CCPA) by strengthening Consumer Privacy Rights and tightening business regulations for personal information use.
This article will discuss the details of CPRA and the changes compared to the current CCPA. Protecting personally identifiable information(PII) and data theft remains even more critical under CPRA, along with adding more enforcement action.
Organizations must review their privacy auditing, data loss prevention, and tokenization through email capabilities to comply with CPRA.
How Will The Law Surrounding Privacy Change?
The California Privacy Rights Act (CPRA) serves as an extension to the CCPA, enhancing the rights of California residents and imposing stricter rules for businesses regarding using personal information.
“This new act also created the California Privacy Protection Agency (CPPA), to help investigate and enforce the CPRA.”
These changes represent significant modifications to California’s data privacy regulations.
The CPRA started on January 1, 2023, and will be enforced from July 1, 2023. All data collected from January 1, 2022, must comply with the new regulations.
CCPA vs. CPRA–Why Two?
The CPRA builds upon the foundation established by the CCPA, clarifying ambiguities, adding regulations, and implementing additional safeguards for users navigating California’s digital infrastructures.
The California Privacy Rights Act (CPRA) applies to for-profit entities handling the personal information of California residents that meets specific criteria.
“Under the CPRA, businesses that disclose the personal information of 100,000 consumers or households will be subject to its regulations.”
This updates the earlier threshold of 50,000 under the CCPA, which may benefit small and medium-sized enterprises.
What are Some of the New Requirements Surrounding CPRA?
The Privacy Rights Amendment to California’s Act (CPRA) changes the regulation restricting website visitors from sharing their data or any information used.
- CPRA will update this button to allow you to provide your website with a link to the CCPA website.
- CPRA introduces a similar mandate on websites that will restrict California consumers’ disclosure of sensitive information.
Who will Enforce the CPRA?
The Attorney General of California will continue to be the enforcement authority. The California Privacy Act extends to the CPPA full authority and jurisdiction to enforce the CCPA. The actual enforcement of CPRA occurs on July 1st, 2023.
What are the Penalties for Violations Involving Children’s Data?
CPRA imposes penalties on those who disclose personal information without consent. The government may seek fines of up to $7500 for intentional violations of the Privacy Protection Act and up to $2500 for offenses involving an adult. The law does not provide additional penalties for individuals whose privacy has been breached. However, organizations failing to show adequate protection controls and completion of required audits also could face additional fines and penalties.
What are the Auditing Requirements under CPRA?
The CPRA requires companies to conduct yearly cybersecurity audits to evaluate the potential risk of personal data to consumers’ privacy. Disclosure of findings is mandatory to comply with CPRA regulations.
Auditing will help organizations determine if they are susceptible to data loss resulting in fines and lawsuits.
Email Security Litigation Facts Around CCPA and CPRA
Under the California Civil Code Section 1798.81.5, an organization or business meeting specific requirements and processes for any California resident data must implement and maintain reasonable security processes and practices appropriate for its information.
Under CCPA and CPRA, litigation only applies to unencrypted sensitive data disclosed or lost. Organizations should encrypt all personal information collected and stored to protect your company against direct or class action litigation related to data loss. The highest level of protection, including email encryption and Data Loss Prevention (DLP) solution, should be enabled to ensure that all email attachments containing personal information are sent securely to the correct recipients.
Role Of Data Loss Prevention In CPRA Compliance
DLP is an effective tool for managing sensitive data. Businesses involved with using or handling the PII of individuals must follow security guidelines to avoid penalties.
Data Loss Prevention solves three significant objectives that apply to most organizations:
- First, is the organization collecting and storing consumer users’ personally identifiable information?
- Second, does the organization have the process and capability to remove the client’s data upon request?
- Third, does the organization have a secure access policy to enable multi-factor authentication based on user actions?
What is the Importance of Data Tokenization to Support the CPRA?
Email messages are vital to our daily communication but can also be a security risk. Sensitive information, such as personal or financial information, can easily fall into the wrong hands if emails are intercepted or hacked.
Industries subject to financial or privacy rules need more secure tokenization solutions to minimize the circulation of specific details while obfuscating critical data leaving the organization. Tokenization helps organizations show their commitment to compliance responsibility to their customers, regulators, and partners.
Tokenization by Trustifi allows a recipient to see your entire email, just like any other email, right from their inbox without having to decrypt or go through any additional steps.
What is the Role of the Email Security Platform from Trustifi?
Preventing fileless malware starts with stopping the phishing email from getting to your user’s inbox. Once the malicious email passes through legacy email security devices, most end-user devices will become infected.
Trustifi, a global leader in cloud-based next-generation email security, understands the complexity of malware. By leveraging AI-powered maturity engines and machine learning, Trustifi can identify malicious emails containing embedded code, rogue attachments, and malicious URL links. Their email security is a trustworthy multi-layered security platform.
- The Trustifi Outbound Shield
- The Trustifi Inbound Shield
- The Trustifi Data Loss Prevention
- The Trustifi cloud-based email archiving for e-discovery
- Trustifi Account Takeover Protection
- Trustifi Data Tokenization
SecOps and email engineers must learn the extent or intent of most fileless malware attacks originating from phishing emails. Access to the Trustifi email security platform gives the organization plenty of options regarding which adaptive security control to deal with challenging attacks, including malware, ransomware, and fileless attacks.
With a “one-click,” clients can enable the various protection layers in minutes without rebooting. To help meet the client’s compliance and privacy mandates, Trustifi also supported the “one-click to comply” strategy.
Supporting the CPRA Privacy Mandates
Trustifi’s consolidated email security strategy for anti-phishing also supports many compliance and privacy mandates out-of-the-box with no additional cost, including:
Why Trustifi?
Trustifi is a cyber security firm featuring solutions delivered on software as a service platform. Trustifi leads the market with the easiest-to-use and deploys email security products, providing both inbound and outbound email security from a single vendor built to stop fileless malware, ransomware, and data exfiltration.
As a global cybersecurity provider of both inbound and outbound email protection, Trustifi currently supports customers from countries including the USA, Canada, Brazil, the Dominican Republic, the UK, the Netherlands, India, the UAE, China, and Japan, Cyprus, the Philippines, and more. The company has also developed “One-Click Compliance” capabilities that cater to world security regulations, including PDPO for Hong Kong, POPI for South Africa, GDPR for Europe, and LGPD for Brazil.
