TheCorporateCounsel.net

In late July, the California Privacy Protection Agency announced its first sectoral audit – focused on “gig economy” platforms. CalPrivacy says this is the first in a series of sectoral audits that evaluate compliance with the California Consumer Privacy Act. CalPrivacy is especially focused on compliance with consumers’ rights to access and exercise control over their personal information.

This Freshfields blog says the audit signals a focus on effective governance and controls around privacy requirements, and that companies in other industries should treat it as a preview of coming attractions. Here’s an excerpt:

The distinction between a single-business enforcement focus and an industry review is notable. Where a traditional investigation asks whether a business has complied with applicable privacy laws—often triggered by a particular incident, complaint, or event—a sectoral audit explores how a business implements privacy obligations across its business functions and whether it achieves compliance on an ongoing basis. For example, regulators may look beyond simply checking whether businesses fulfilled access or deletion requests and instead evaluate whether a business has built the underlying architecture to maintain compliance. Specifically, regulators may look at how businesses:

– Receive, track, and fulfill access and deletion requests across systems
– Monitor and enforce statutory deadlines
– Establish privacy governance structures
– Allocate privacy compliance responsibilities across teams and departments
– Audit, document, and verify compliance with legal obligations.

In short, a sectoral audit looks past isolated compliance outcomes to examine the processes and accountability mechanisms that produce them.

The blog recommends testing whether privacy compliance is operationalized. Check out our “Data Privacy” Practice Area for other recent developments and resources on risk management.

– Liz Dunshee