<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=654132&amp;fmt=gif">

A Guide to Privacy Impact Assessments for CPRA, CPA, and VCDPA

In the United States, assessments are quickly becoming one of the trending requirements of new legislation and proposed bills. CPRA, CPA, and VCDPA all have privacy impact assessment requirements, and as 2023 approaches rapidly organizations should be thinking about how to complete assessments, where to store them, and reporting on assessment outcomes.

All Posts

A Guide to Privacy Impact Assessments for CPRA, CPA, and VCDPA

In the United States, assessments are quickly becoming one of the trending requirements of new legislation and proposed bills. CPRA, CPA, and VCDPA all have privacy impact assessment requirements, and as 2023 approaches rapidly organizations should be thinking about how to complete assessments, where to store them, and reporting on assessment outcomes.

The Utah Consumer Privacy Act heads to Gov. Spencer Cox, who can sign the bill within 20 days veto the bill, or most likely allow it to become law at the end of 20 days with no action. As of right now there is no assessment requirement, but with the AG having authority to make changes that could be added in the future. Indiana, Oklahoma, and Wisconsin are rapidly following in Utah’s footsteps. The story continues as almost on a weekly basis a new state is proposing a law.

Michael Hellbusch, Partner at Rutan & Tucker, says “Businesses want and need to be efficient when faced with the multi-jurisdiction regulatory landscape we have in the United States. While state privacy laws are thematically largely the same, the devil is in the details. Being efficient means understanding where compliance efforts in one state can work for another state—and where they can’t. Mapping privacy impact assessment requirements across multiple jurisdictions is an efficient way to handle the increasingly complex U.S. privacy landscape.”

Privacy impact assessments across the board are going to call on controllers to assess their privacy and compliance for activities that run a high risk of consumer harm by analyzing protocols, data storage, access request response, and more. While assessments are becoming standard, each privacy law has variances in how they’re addressed.

Here is a breakdown of assessment requirements and pertinent information for CPRA, CPA, and VADPA.

 

 

CPRA

CPA

VCDPA

Assessment Start Date

January 1, 2023

No lookback period provided. Likely to be required for all ongoing processing activities subject to assessment.

July 1, 2023

No lookback period provided. Likely to be required for all ongoing processing activities subject to assessment.

January 1, 2023

No lookback period provided. Likely to be required for all ongoing processing activities subject to assessment.

Processing Activities Triggering Assessment

Processing of personal information that presents a significant risk to consumers’ privacy or security (likely to be further defined by the CCPA)

Processing of personal information that presents a heightened risk of harm to a consumer.

Processing of personal data that present a heightened risk of harm to consumers.

Processing Activities Automatically Subject to Risk Assessments

Set forth by the CCPA, but will include:

·      Processing Sensitive Personal Information

 

·      Targeted advertising

·      Profiling, if the profiling presents a risk of (i) unfair or deceptive treatment of consumers; (ii) unlawful disparate impact on consumers; (iii) financial or physical injury to consumers (iv) other substantial injury to consumers.

·      Selling of Personal Information

·      Processing Sensitive Personal Information

·      Targeted advertising;

·      Profiling, if the profiling profiling presents a reasonably foreseeable risk of (i) unfair or deceptive treatment of consumers; (ii)unlawful disparate impact on consumers; (iii) financial, physical, or reputational injury to consumers; (iv) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; or (v) other substantial injury to consumers;

·      Selling of Personal Data

·      Processing Sensitive Personal Data

 

Assessment Requirements

Set forth by the California Privacy Protection Agency, but assessments must:

·      Identify and weigh the benefits resulting from the processing to the business, the consumer, other stakeholders, and the public against potential risks to the rights of the consumer.

·      work toward the goal of restricting or prohibiting processing when the risks outweigh the benefits.

Assessments must:

·      identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with the processing;

·      identify safeguards that the controller can employ to reduce the risks.

·      factor in (i) the use of de-identified data (ii)the reasonable expectations of consumers, and (iii) the context of the processing and (iv) the relationship between the controller and the consumer whose personal data will be processed.

Assessments must:

·      identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with the processing;

·      identify safeguards that the controller can employ to reduce the risks.

·      factor in (i) the use of de-identified data (ii)the reasonable expectations of consumers, and (iii) the context of the processing, and (iv) the relationship between the controller and the consumer whose personal data will be processed.

 

Definition of Sensitive Data

The CPRA defines “sensitive personal information” as “personal information that reveals (a) consumer’s Social Security or other state identification number; (b) a consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) consumer’s geolocation; (d) consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership; (e) the contents of a consumer’s mail, email, or text messages, unless the business is the intended recipient of the communication; and (f) consumer’s genetic data. It also includes processing of biometric information for purposes of identifying a consumer; personal information collected and analyzed concerning a consumer’s health, and personal information collected and analyzed concerning a consumer’s sex life or sexual orientation.”

“Personal data revealing racial or ethnic origin,

religious beliefs, a mental or physical health condition or

diagnosis, sex life or sexual orientation, or citizenship or

citizenship status; genetic or biometric data that may be processed for the

purpose of uniquely identifying an individual; or personal data from a known child”

“Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; the processing of genetic or biometric data for the purpose of uniquely identifying a natural person; the personal data collected from a known child; or the precise geolocation of an individual.”

Cross-Over Use

No indication, possibly to be addressed by the CPAA.

A single data protection assessment may address a comparable set of processing operations that include similar activities.

 

Data protection assessments conducted by a controller for the purpose of compliance with other laws or regulations may comply under this section if the assessments have a reasonably comparable scope and effect.

Vendor Assistance In Conducting Risk Assessments

A contract with a service provider, contractor, or third party must grant the business rights to take reasonable and appropriate steps to help ensure that the third party , service provider uses the personal information in a manner consistent with the business’s obligations under the CPRA.   Presumably, this includes the right to request information necessary to conduct risk assessments.

A processor is required to provide information to the controller necessary to enable the controller to conduct and document any data protection assessment.

A processor is required to provide information to the controller necessary to enable the controller to conduct and document any data protection assessment.

Third-Party Assessments

A business is permitted to monitor a service provider’s compliance with contractual terms through regular assessments. However, this right is not mandatory for service provider agreements.

 

A business is permitted to monitors a contractor’s compliance with contractual terms through regular assessments. This right must be included in contractor agreements.

 

Processing by a processor must be governed by a contract that requires the processor to make available to the controller all information necessary to demonstrate compliance with processors CPA obligations.  

 

 

Processing by a processor must be governed by a contract that requires the processor to make available to the controller all information necessary to demonstrate compliance with processors VCDPA obligations.  

 

Assessment Frequency

No indication, but likely required for ongoing processing activities subject to assessments.

 

No indication, but likely required for ongoing processing activities subject to assessments.

No indication, but likely required for ongoing processing activities subject to assessments.

Requirement to Submit Risk Assessment to Governmental Agency

The CPPA is tasked to issue regulations requiring businesses to submit risk assessments to the CPPA on a regular basis.

The attorney general and district attorneys are empowered to access and evaluate a company's data protection assessments.

 

The Attorney General may request, in writing, that a controller disclose any data protection assessment that is relevant to an investigation conducted by the Attorney General, and the controller shall make the data protection assessment available to the Attorney General.

 

The Attorney General may evaluate the data protection assessment for compliance with the responsibilities set forth the VCDPA.

 

The Utah Consumer Privacy Act does not have an explicit provision related to privacy impact assessments, but there is language which implies that risks assessments should be done. The language in subsection (a)(ii) talks about reducing the reasonably foreseeable risk of harm to consumers related to the processing of personal data. Anytime you must account for a “foreseeable risk of harm” the covered entity must assess the risks of harm. Therefore, entities will need to assess the risks associated with the processing activities and implement the appropriate practices to reduce those risks. The risks of harm associated with the processing of personal data go beyond risks to the confidentiality and integrity described in subsection (a)(i) and would include privacy risks of the type to be assessed in a privacy risk assessment.

As 2023 looms closer and closer, organizations that fall under the parameters of these laws will need to have privacy impact assessment protocols in place sooner than later. Tools like Truyo’s Privacy Impact Assessment tool can drastically reduce the amount of time it takes to complete assessments, provide ample reporting needed for these laws, and give you the ability to simplify third-party assessments.

If you’re looking for a privacy impact assessment tool to help you simplify the process of preparing for CPRA assessments, Colorado Privacy Act assessments, and Virginia Consumer Data Privacy Act assessments, we would be happy to demo our product for you and give you a free trial so you can see start your road to compliance today.

Ale Johnson
About Ale Johnson
Ale Johnson is the Marketing Content Specialist at Truyo.
Recent Posts

A Guide to Privacy Impact Assessments for CPRA, CPA, and VCDPA

In the United States, assessments are quickly becoming one of the trending requirements of new legislation and proposed bills. CPRA, CPA, and VCDPA al...

India's Joint Parliamentary Committee Announces Recommended Changes to Privacy Bill

Last month, the Indian Joint Parliamentary Committee submitted its report on the 2019 Personal Data Protection Bill after two years of consideration, ...

Log4J Vulnerability Update

At Truyo we take data privacy and security very seriously. Recently a security vulnerability was reported in the open-source Java library “Log4J” that...

Forrester Wave Announcement: Truyo Named Strong Performer

Report notes Truyo’s “management and fulfillment of individual privacy rights capabilities are some of the best in the market ” PHOENIX (Dec. 09, 2021...