CPPA Board Holds Meeting on Revised Draft Regulations for Risk Assessment and Automated Decisionmaking Technology
On March 8, 2024, the California Privacy Protection Agency (“CPPA”) Board discussed and voted 3-2 in favor of further edits to revised draft regulations regarding risk assessments and automated decisionmaking technology (“ADMT”), which were released in February 2024, but did not initiate the formal rulemaking process for these regulations, which is anticipated to begin in July 2024.
The revised draft regulations contain the following key changes and provisions:
Risk Assessments
- Risk Assessment Thresholds
- Update the list of processing activities that require a risk assessment, which include: (1) selling or sharing personal information; (2) processing sensitive personal information (including the personal information of consumers that the business has actual knowledge are less than 16 years old); (3) using ADMT for a significant decision or “extensive profiling” (i.e., work or educational profiling, public profiling, or profiling a consumer for behavioral advertising); and (4) when training ADMT or artificial intelligence…
