The nation’s first and only data privacy regulator, the California Privacy Protection Agency or CalPrivacy as it’s now known, has made several notable actions since its founding in December 2020. In addition to fulfilling its responsibility to create regulations on several topics related to the state’s data privacy law, the agency has also handed down its first penalty of over $1 million against lifestyle retailer Tractor Supply Co for several alleged compliance missteps, including failing to properly notify consumers and job applicants of their privacy rights.
Speaking to Law360, Finnegan partner and leader of the firm’s privacy practice Lynn Parker Dupree said CalPrivacy's latest enforcement action against Tractor Supply—its third overall under the California Consumer Privacy Act (CCPA)—highlighted "the ongoing maturation of regulatory oversight in California" in both size and scope.”
"This enforcement action [against Tractor Supply] underscores that the CCPA extends protections to both consumer and employee data," Lynn said. "It is essential for organizations to ensure that their privacy practices are effectively implemented within their business operations. Inadequate choice architecture that misleads individuals regarding the use of their personal information, or insufficient communication about consumer and employee rights, does not meet the legal requirements established by the CCPA."
The Tractor Supply action, along with the agency's prior CCPA enforcement strikes against national clothing retailer Todd Snyder Inc. and American Honda Motor Co., additionally demonstrates that CalPrivacy "expects full compliance with the CCPA from all organizations subject to its provisions, regardless of industry sector," and that it won't hesitate to apply regulatory scrutiny broadly, Lynn added.
Read “Calif. Privacy Agency Gaining Steam Ahead of 5th Anniversary”
