Business/Commercial accounts/loans have a one year exemption from CCPA. We have asked our attorney the same questions, and was advised to wait to see the final regulations from the CA attorney general and if any additional changes are made by the Legislature during 2020.

Also beware, that the organization behind CCPA, does not think that the current version of CCPA goes far enough and is trying to get an initiative on the fall ballot. https://www.caprivacy.org/

Link to redlined version of latest CA privacy proposed regulation.

https://oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-text-of-mod-redline-020720.pdf?

Comments on the modified proposed regulations are due the CA Attorney General by Feb. 25 at 5pm.

https://oag.ca.gov/privacy/ccpa

Now that this is effective, has anyone determined what PI if any is exempted under GLBA? If you receive a copy request, what are you giving them?

Based on the GLBA and California Financial Information Privacy Act, all PI we collect on members (we are a credit union) is exempt from CCPA. However any PI we collect on consumers associated with business account/commercial loans is not exempt from CCPA, nor is our own employee PI. If a member submits a request, we advise them that their PI is exempt from CCPA and that we comply with federal and state privacy laws.

FYI there is ballot measure that could make all this much more fun.
https://voterguide.sos.ca.gov/propositions/24/
https://vig.cdn.sos.ca.gov/2020/general/pdf/topl-prop24.pdf

What is the delivery timing requirement for the CA Privacy Notice?

ex. Within three days after application? At the time of application (prior to application)? Before applicant information is collected? Etc...

The Notice at Collections must given prior to any personal information is collected from a consumer.

So before they even apply for a loan application? (since there are certain information needed for an application)

Yes. Keep in mind, personal information collected for opening, maintaining, or servicing a personal account/loan is exempt as this personal information falls under GLBA or CalFIPA. Personal information that is collected for employment, business banking, commercial lending, marketing and other areas is not exempt from CCPA.

Am I right that business to business and employment exemptions were extended to 2023 by the new ballot initiative?

Yes, but you still need to provide the Notice at Collection beginning no later than 1/1/2022, due to the look back period for responding to requests that begins 1/1/2023. We've had our Notices posted since July for employment and business, and all marketing related items have had a form of the Notice since January.

Reviving this thread...

Does anyone have a CCPA audit checklist or something similar that they'd be willing to share?

The new California Privacy Protection Agency (CPPA) has begun its proposed rulemaking to enact the recently passed California Privacy Rights of Act of 2020, that amends the CCPA. Here is the link to their preliminary questions that are due on 11/8.

https://cppa.ca.gov/regulations/pdf/invitation_for_comments.pdf

The California Privacy Protection Agency (CPPA) has issued draft regulations for CCPA that are required by CPRA. The draft regulations will be discussed at the next CPPA Board meeting on June 8.

https://cppa.ca.gov/meetings/materials/20220608_item3.pdf