USA – CALIFORNIA Trends and Developments Contributed by: Christina M. Morgan and David M. Liu, Buchalter LLP
cybersecurity audit. Processing of personal informa - tion presents significant risk to consumers’ security if: • the business derived 50% or more of its annual revenue from selling or sharing consumers’ per - sonal information in the preceding calendar year; or • the business had annual gross revenue in excess of USD25 million in the preceding calendar year and: (a) processed personal information of 250,000 or more consumers or households in the preced - ing calendar year; or (b) processed the sensitive information of 50,000 or more consumers in the preceding calendar year. Businesses must use a qualified, objective, independ - ent professional using procedures and standards rec - ognised within the auditing profession. Businesses must make good-faith efforts to disclose all relevant facts and make sure the auditor has access to all rel - evant information. Attestations are insufficient. The audit must assess how the business’s cyberse - curity programme protects personal information from unauthorised access, destruction, use, modification, or disclosure, and protects against unauthorised activity resulting in the loss of availability of personal information. This includes evaluating the strength of passwords, the use of multi-factor authentication, encryption practices, account management and access controls, the security of hardware and software being used by the business, and network defences. Once an audit report is complete, the business must certify to the CPPA that it has completed the required audit. The certification must be completed by a mem - ber of the business’s executive management team. When a business must start completing cybersecurity audits depends on the business’s annual revenue. Businesses with more than USD100 million in annual gross revenue in 2026 must comply with the new audit requirements by 1 April 2028. The audit should cover 1 January 2027 through 1 January 2028.
Businesses with annual gross revenue between USD50 million and USD100 million in 2027 must comply with the new audit requirements by 1 April 2029. The audit should cover 1 January 2028 through 1 January 2029. Businesses with less than USD50 million in annual gross revenue in 2028 must comply with the new audit requirements by 1 April 2030. The audit should cover 1 January 2029 through 1 January 2030. After 1 April 2030, businesses must complete an audit that covers the calendar year. The audit report must be completed by 1 April of the following year. Risk assessments Every business whose processing of consumers’ per - sonal information presents significant risk to consum - ers’ privacy must conduct a risk assessment before initiating that processing. The following processing activities present a significant risk to consumers’ pri - vacy: • selling or sharing personal information; • processing sensitive personal information; • using ADMT for a significant decision concerning a consumer; • using automated processing to infer or extrapolate a consumer’s intelligence, ability, aptitude, perfor - mance at work, economic situation, health (includ - ing mental health), personal preferences, interests, reliability, predispositions, behaviour, location, or movements, based on: (a) a systematic observation of that consumer when they are acting in their capacity as an educational programme applicant, job appli - cant, student, employee, or independent con - tractor for a business, or (b) the consumer’s presence in a “sensitive loca - tion”, such as a hospital, pharmacy, domestic violence shelter, or food pantry; • processing personal information that the business intends to use to train: (a) an ADMT for a significant decision concerning a consumer; (b) facial recognition technology; (c) emotion recognition technology; or
567 CHAMBERS.COM
Powered by FlippingBook