California recently passed a sweeping new consumer privacy law that will have major implications for businesses that collect, store, and share information about California residents. The law goes into effect on January 1, 2020, but businesses that collect any California consumer information should begin preparing for the law’s requirements as soon as possible.
The first of its kind in the United States, the California Consumer Privacy Act (CCPA) gives a number of rights to California residents to allow them to better understand and control what kinds of information businesses collect about them and how businesses use and share such information. The CCPA has many similar concepts and requirements as the European General Data Protection Regulation (GDPR); however, there are several significant differences. Being in compliance with GDPR does not guarantee compliance with CCPA.
The CCPA applies to for-profit entities doing business in California that meet certain revenue and/or data collection thresholds. Compared to the GDPR, the CCPA covers an even broader scope of data including not just personal identifying information, but also any information capable of being used in conjunction with other information to identify an individual person or household. New requirements of the CCPA include individual rights to data access and erasure, and limitations on the use of consumer data. The law also gives consumers the right to opt-out of having their data sold via a clear and conspicuous link on a business’s website.
Like the GDPR, violations of the CCPA may result in significant fines. To ensure compliance when the law takes effect January 1, 2020, businesses should update their privacy policies and begin developing compliance plans to be able to track what kinds of data is collected, stored, shared, and sold and to respond to consumers’ requests for copies of the data stored about them, “Do Not Sell” requests, and data deletion requests. Businesses should ensure that they have a comprehensive, accurate, and up-to-date inventory of all the data they collect share, and/or sell concerning California residents.
With experience drafting privacy policies, we encourage you to consult a Deborah A. Nilson & Associates, PLLC attorney if you have specific questions or concerns relating to the CCPA.