On October 8, 2023, California Governor Gavin Newsom signed two significant amendments to the California Consumer Privacy Act (CCPA), AB 947 and AB 1194. These amendments, which go into effect on January 1, 2024, extend protections to certain data types, specifically reproductive health and citizenship status.

Extension of Sensitive Personal Information Definition

AB-947, one of the amendments to the CCPA, extends the definition of “sensitive personal information” to include citizenship and immigration status. This is a significant change as current categories of sensitive personal information include precise geolocation, racial or ethnic origin, religious beliefs, and genetic data.

Citizenship and immigration status are already considered sensitive data under privacy laws in Connecticut and Virginia. Collecting sensitive personal information in California triggers certain notice, use, and opt-out rights. This means businesses must provide notice to consumers at or before the point of collection if they intend to collect this type of information. Consumers also have the right to opt out of the sale or sharing of their sensitive personal information.

Strengthening Reproductive Privacy Rights

AB 1194, the second amendment, specifically carves out reproductive health data. This means that information related to “accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services” need not be provided in an official investigation.

It does not limit a business’s obligations to preserve information in a civil proceeding or where required by law. These amendments were prompted by heightened concerns involving government access to records of individuals seeking reproductive healthcare following the Dobbs decision at the Supreme Court.

Implications for Businesses

Businesses should refresh their data mapping exercises to identify where they may collect personal information related to citizenship, immigration status and reproductive health. For citizenship or immigration status information, the CCPA’s sensitive personal information requirements should be adopted.

The Role of Government Agencies

CCPA currently allows businesses to cooperate with law enforcement and government agencies by providing personal information that is requested pursuant to official investigations. However, with AB 1194 specifically carving out reproductive health data, this means that such information need not be provided in an official investigation.

These amendments follow a trend with other types of California amendments strengthening reproductive privacy protections, as well as other states and FTC’s heightened concerns about information involving a person’s health that might not be covered by HIPAA. This suggests a future where privacy laws become more robust and take into account the sensitivity of certain types of personal information. It also indicates a shift towards more consumer-centric laws where the rights and protections of consumers are prioritized.

Businesses operating in California will need to ensure they are compliant with these new requirements by the time they come into effect on January 1, 2024.