California's Prop 24 Data Protection Rule Passes

While the presidential election is still undecided, voters in California set a new standard on Tuesday for customer privacy by passing Proposition 24, which will make it harder for companies to collect and share their personal data.

The law, called the Consumer Privacy Rights Act (CPRA), was approved by 56 percent of California voters on Election Day Nov. 3. It allows consumers in California to block companies from selling or sharing their personal information, limits how websites track data that they often sell to advertising partners, triples fines against companies that violate kids' data policies, establishes an enforcement arm for consumers.

Joe Gaska, CEO and founder of GRAX, a provider of cloud-based data backup, archiving, and recovery tools that let consumers take full ownership and control of their data, notes that the new requirements place a greater importance on data ownership.

"The passing of Proposition 24 in California clearly showcases the importance of organizations owning their data from end-to-end and knowing who has access to their data, also known as maintaining the digital chain of custody," he says. "Today, over 95 percent of businesses rely on data that's stored in vendors' cloud-based applications. They are effectively forced to lease their own data back from these providers. With a greater responsibility placed on businesses to manage cybersecurity audits and risk assessments through the CPRA, this practice leaves organizations at a greater risk for non-compliance, as they have less visibility and control over who accesses their data, how they access it, and how much risk is involved in its handling.

"To ensure compliance, organizations must fully own their data. Only then can they have real-time, complete access to all data backups and data archives, critical to enabling the peace of mind that allows organizations to focus on innovation," he adds.

Prop 24 isn't expected to become enforceable until 2023. It comes on the heels of California's passage of the statewide California Consumer Privacy Act (CCPA), which passed in 2018 and took effect earlier this year.

Both the CCPA and the new Prop 24 legislation apply only to consumers in California, which has prompted privacy advocates to charge that the law doesn't go far enough, calling instead for Congress to enact legislation that would set a national privacy standard similar to the European Union's General Data Protection Regulation (GDPR).