Newsroom

While the California Consumer Privacy Act (CCPA) takes effect Wednesday, NAFCU's Elizabeth LaBerge notes that "the actual regulatory requirements detailing how to comply with the law are not yet finalized" in a new Compliance Blog post. NAFCU is an advocate for a uniform federal standard – not a patchwork of state privacy laws – and recently unveiled principles for a national data privacy standard.

A previous Compliance Blog post explained the proposed regulations, and NAFCU outlined a number of concerns to the California attorney general.

LaBerge, NAFCU's senior regulatory compliance counsel, explains that enforcement under the CCPA will likely not begin until July 1, as the law stipulated enforcement actions would not be brought during a grace period after the publication of final implementing regulations. Final regulations are not expected until April. Additionally, some provisions have been delayed until Jan. 1, 2021, based on how the personal information about certain California residents is collected.

"The CCPA applies to the personal information of a consumer who is a California resident," writes LaBerge. "The CCPA does not care about the context during which the information is collected. An individual's personal information could be collected in connection with the opening of a consumer account or loan, but it could also be collected in connection with the individual serving as a beneficial owner of a member business, an authorized signor for a corporate account, or as an employee of the credit union.

"Because the personal information of an individual California resident would be collected in these situations, the rights and requirements of the CCPA would apply under the current law. Amendments to the CCPA did delay its applicability to these situations," she adds.

LaBerge further details delays of certain provisions of the law due to amendments passed before the closure of California's 2019 legislative session. Read the full blog.

NAFCU joined with the U.S. Chamber of Commerce and other organizations representing every sector of the American economy to urge California leaders to delay the effective date of the CCPA by two years.

In addition to the CCPA, other regulatory changes taking effect this week include:

• credit unions that reported at least 60,000 covered loans and applications, combined, in the preceding calendar year will be required to conduct quarterly data submissions under the Home Mortgage Disclosure Act;
• changes to the Federal Reserve's fee schedules for payment services the Fed Banks provide to depository institutions; and
• the Small Business Administration's changes to streamline and modernize its Certified Development Company (CDC) program corporate governance requirements.