Exempt institution, covered data: what Proposition 24 meant for banks and hospitals

The week

On November 3, 2020, alongside the presidential election, California voters approved Proposition 24, the California Privacy Rights Act. It amended the California Consumer Privacy Act, which had taken effect at the start of 2020. The measure created the California Privacy Protection Agency, a standalone regulator with rulemaking and enforcement powers. It added a category of sensitive personal information with a right to limit its use, a right to correct inaccurate data, and rules on sharing data for cross-context behavioral advertising. Most new provisions became operative on January 1, 2023. The measure also extended, until that date, temporary exemptions for employee and business-to-business data.

Most commentary on Proposition 24 focused on consumer technology and advertising. For regulated institutions the important point was structural. California’s privacy law does not exempt a bank or a health system as an organization. It exempts specific categories of data governed by federal law. That distinction was easy to overlook in November 2020 and grew expensive later. The change for regulated institutions has three parts: a dedicated regulator, exemptions that follow the data, and new rights that land on operations.

A dedicated regulator

Before the vote, enforcement of the California Consumer Privacy Act sat with the state attorney general, whose office had many other priorities. The new California Privacy Protection Agency had one job. A dedicated regulator writes detailed rules, issues guidance and builds expertise in how consent screens, request forms and data flows actually work. It also finds the mechanics worth examining that a generalist office might not.

The measure gave the agency rulemaking authority over topics the statute barely defined. Those included automated decision-making, risk assessments for processing that presents significant risk, and cybersecurity audits. For compliance leaders, the requirements would keep moving after the vote. A program built to the statute’s text in 2021 would be incomplete by design.

The practical consequence was a monitoring task. Someone in each institution needed to follow the agency’s rulemaking, assess each draft against the institution’s data map, and budget for changes before they were final. Leaving that to outside counsel alone risks learning about a requirement only when it is final, with little time left to change systems.

Exemptions that follow the data

The exemptions for financial and health information are the part regulated institutions most often misread.

For financial institutions, the law exempts personal information collected, processed, sold or disclosed under the Gramm-Leach-Bliley Act. That covers much customer account data. It does not cover everything a bank holds. Website analytics on visitors who never became customers, marketing lists, some prospect data and, once the temporary exemption expired, data about employees and business contacts can all fall inside the California law.

For health care, the law exempts protected health information held by covered entities and business associates under HIPAA. It also exempts providers and covered entities to the extent they maintain patient information in the same manner as protected health information. A health system’s website tracking, consumer wellness apps, some fundraising and marketing data, and employee information can still fall outside that boundary. California’s own Confidentiality of Medical Information Act adds another layer for medical information.

Public agencies were generally outside the law. Their contractors and vendors often were not, at least for data handled outside the public contract.

The consequence is the same in all three sectors. The question “are we covered?” cannot be answered at the level of the institution. It has to be answered data set by data set. That requires a map recording, for each significant data set, which law governs it, which systems hold it, and who owns it. Organizations should check with counsel on how the exemptions apply to their specific data, because the boundaries are detailed and fact-specific.

New rights that land on operations

The third part is operational. Each new right translates into a process that has to reach real systems.

• The right to correct needs a request process that can find the data across systems, decide whether it is inaccurate and fix it within set timelines. For a bank, that may touch a marketing platform, a prospect database and an HR system owned by three teams.
• The right to limit use of sensitive personal information requires knowing where such information is used beyond what is necessary to provide a service, including in analytics.
• Rules on cross-context behavioral advertising reach the tracking pixels and tags embedded in public websites. Marketing teams often add those without involving compliance.

Each of these is more about plumbing than policy. They need a reliable data inventory, a way to verify requesters without collecting more data than necessary, and workflows that reach systems owned by different teams. Institutions with mature records management and data catalogs found the work tractable. Those relying on manual searches across email and shared drives did not.

Timing mattered too. The exemptions for employee and business-to-business data were temporary from the start, extended by the measure only to January 1, 2023. Many organizations deferred that work, reasonably, then compressed it into the final months of 2022. Treating a sunset date as a planning date, instead of hoping for another extension, spreads the effort.

The data map that California demanded did not stay a California asset. It served as the base for every state law that followed. Institutions that built it once, and kept it current as systems changed, spent their later effort on genuinely new requirements. Those that answered each new law with a separate project kept rediscovering where their data was.

With hindsight

The California Privacy Protection Agency has been an active regulator. Its first regulations took effect in 2023. In September 2025 its rules on automated decision-making technology, risk assessments and cybersecurity audits were approved, taking effect at the start of 2026 with compliance obligations phased in through 2030. Its early enforcement focused on mechanics, such as how opt-out requests were verified and how consent interfaces were designed, rather than on dramatic breaches.

Meanwhile a long list of other states passed comprehensive privacy laws, starting with Virginia in 2021. Each took its own approach to financial and health data: some exempt entities, others only data. A federal privacy law was proposed several times and did not pass. The 2020 vote marked the start of privacy compliance in the U.S. as a permanent, state-by-state data mapping discipline, including for institutions that believed federal law already covered them.