CCPA (Cal­i­for­nia Consumer Privacy Act)

Following a major consumer data scandal involving Facebook and Cambridge Analytica in 2018, several new privacy reg­u­la­tions were es­tab­lished. The General Data Pro­tec­tion Reg­u­la­tion or GDPR is among the most widely pub­li­cized. It ensures that companies are fined if they violate consumer data rights. Although the GDPR applies to some US companies doing business in the EU, it’s largely a European ini­tia­tive. That’s why the Cal­i­for­nia Consumer Privacy Act or CCPA was enacted in 2018 to ensure that US consumers could demand that companies in pos­ses­sion of their data would delete it if asked to. The new law went into action on January 1, 2020. But what is the CCPA? What are its major pro­vi­sions? And how does it differ from the GDPR?

The CCPA is a consumer privacy act (AB 375) which enables Cal­i­for­nia residents to request to see all the personal in­for­ma­tion a company serving in the state of Cal­i­for­nia may hold on them. In addition, companies must disclose which third parties they have shared the data with. If the law is violated, consumers are able to sue a business for breach of reg­u­la­tion.

It was signed into law by Jerry Brown, the Cal­i­for­nia Governor, in June 2018, and orig­i­nal­ly born from a ballot ini­tia­tive that collected over 600,000 sig­na­tures. The final Act is widely con­sid­ered to be prefer­able over a ballot ini­tia­tive because it can be amended in the future. In contrast, ballot measures – once initiated – cannot be easily amended.

De­f­i­n­i­tions of what one considers to be “private” or “personal” can differ from company to company. Under the CCPA, personal in­for­ma­tion is defined as any data that could identify, describe, or in­di­rect­ly link to a person. Whilst name, email, date of birth, and address are clear examples of personal data, the Act goes much further. For example, it includes com­mer­cial in­for­ma­tion such as any records of products that a consumer purchased or rented. Other cat­e­gories of “personal” in­for­ma­tion protected under the Act include online ac­tiv­i­ties such as a user’s browsing history, audio history, ge­olo­ca­tion data, or em­ploy­ment-related in­for­ma­tion. However, it does not cover in­for­ma­tion that is publicly available. You can view a full list of what con­sti­tutes “personal” in­for­ma­tion under the CCPA here.

The Act has several major pro­vi­sions that US busi­ness­es must adhere to. For example, consumers can request to know which personal in­for­ma­tion a company holds on them. At the same time, companies must state what kind of in­for­ma­tion they collect as part of their privacy policy and what the purpose for col­lect­ing this in­for­ma­tion may be. Cal­i­for­nia residents could also request to know what their in­for­ma­tion is being used for and who it has been shared with.

Consumers now have the right to opt out of busi­ness­es selling their in­for­ma­tion to others. If a consumer requests that their data be deleted, companies aren’t allowed to refuse their service with some ex­cep­tions. For example, a health­care insurer wouldn’t be able to provide a service without col­lect­ing certain consumer data like date of birth or known health con­di­tions.

The Act also stip­u­lates that busi­ness­es must provide a website and a free-to-call phone number for consumers to make a request to have their data deleted. To request deletion of data at IONOS for example, this request must be submitted in writing via email to legal@ionos.com, and customers may call 1 877 206 4253 for any related questions. Any requests made by a consumer to view their personal in­for­ma­tion must be followed up on within 45 days after being received. From January 2020 forwards, companies need to verify records dating back 12 months.

Here’s an overview of some of the CCPA’s major stip­u­la­tions:

• Consumers can ask to view the in­for­ma­tion a business has collected on them (including the type of data and format) and shared with any third parties dating back 12 months
• Consumers can request their in­for­ma­tion to be deleted
• Consumers may opt out of their data being sold
• Consumers have a right to not be refused service, with some ex­cep­tions
• Consumers have a right for their request to be answered within 45 days

The Act applies to all for-profit companies that provide services or products to residents in the US state of Cal­i­for­nia which:

• Earn over $25 million in revenue each year
• Have collected personal data on more than 50,000 Cal­i­for­nia residents
• Make 50% of their revenue from selling personal in­for­ma­tion of Cal­i­for­nia residents

This means that a business doesn’t nec­es­sar­i­ly have to be based in Cal­i­for­nia or even in the US to have to comply with the CCPA. Indeed, an in­ter­na­tion­al company that falls under the above will also need to adhere to the Act.

In reality, given Cal­i­for­nia’s large pop­u­la­tion, many major companies are already serving Cal­i­for­nia residents. Although busi­ness­es can install IP trackers to monitor whether they’re serving Cal­i­for­nia customers, such costly tech­no­log­i­cal additions may not be suitable for all busi­ness­es. It’s, therefore, more likely that busi­ness­es will update their privacy policies to comply with the Act for all their customers. As data laws keep changing to address privacy concerns by consumers, it’s expected that most US states will adopt more stringent reg­u­la­tions in the near future.

Small companies which do not collect large amounts of data, non-profit or­ga­ni­za­tions, and sole pro­pri­etors which do not collect data or earn more than the threshold aren’t covered under the Act. There are some other companies which are exempt from the CCPA law, including insurance providers, agents, and support or­ga­ni­za­tions. That’s because the latter are already covered under the Cal­i­for­nia Insurance In­for­ma­tion and Privacy Pro­tec­tion Act.

The CCPA took effect on January 1, 2020. This means all relevant busi­ness­es now need to comply with the reg­u­la­tions. However, because consumers can request data dating back 12 months, most busi­ness­es should have had data col­lec­tion and man­age­ment systems in place since the start of 2019.

If a consumer complains that the Act has been violated, companies have 30 days to comply with the law. Where a business does not act swiftly or fails to comply, they may face fines up to $7,500 per case. For a company that deals with thousands of consumer records, in­ten­tion­al or un­in­ten­tion­al non-com­pli­ance could quickly become costly.

What’s more, thanks to the bill, consumers have the right to sue a company for the first time – either in­di­vid­u­al­ly or as a class. At the moment, it’s not known what statutory damages in the event of a class-action lawsuit could look like or what the upper threshold may be. It’s, therefore, advised that companies take the Act seriously and ensure they comply. However, companies can avoid fines and lawsuits as long as they respond to customers within 30 days and make any requested amend­ments swiftly.

For unau­tho­rized access and data breaches, for example, theft or neg­li­gence, the Act states that consumers can receive damages between $100 to $750 per customer and incident.

Because many large busi­ness­es in the US also provide products and services in Europe, they will have already updated their privacy policies to comply with the GDPR. As such, they’re already on track to comply with much of the CCPA as some of the pro­vi­sions are similar between the two. But how similar are the CCPA and the GDPR?

The CCPA is often dubbed the “American GDPR.” That’s because, in essence, many of its pro­vi­sions are similar to the European coun­ter­part. However, the CCPA is seen as a slightly more expansive and arguably stricter law than the GDPR. One of the main dif­fer­ences between the CCPA and the GDPR is the opting-out arrange­ment. Whilst the GDPR requires companies to allow consumers to opt out of data pro­cess­ing, the CCPA only enables opting out of the sale of personal in­for­ma­tion. That means companies can still collect private data, but can’t sell it without consent. The key dif­fer­ences and sim­i­lar­i­ties between the two are shown in the table below.

Sources: PWC and In­for­ma­tion Com­mis­sion­er’s Office

The CCPA has far-reaching con­se­quences for many busi­ness­es in the US and abroad. “Our personal data is what powers today’s data-driven economy and the wealth it generates. It’s time we had control over the use of our personal data. That includes keeping it private,” said Xavier Becerra, the Cal­i­for­nia Attorney General. As a con­se­quence, companies may incur con­sid­er­able costs to comply with the Act. They should also prepare for a large number of incoming consumer requests and the even­tu­al­i­ty of fines and lit­i­ga­tion. Companies that already comply with the GDPR will need to carefully examine whether they should make ad­di­tion­al updates to their privacy policies. Over the next few years, there’ll likely be several updates to the CCPA and busi­ness­es will need to make sure they keep up with changing reg­u­la­tions.

The Cal­i­for­nia Consumer Privacy Act is seen as the beginning of a wave of privacy reg­u­la­tions sweeping the US. Experts predict that 2020 will be a key year for major updates to consumer personal data pro­tec­tion laws, es­pe­cial­ly in states like New York and Mass­a­chu­setts, where the New York Privacy Act and the Act Relative to Consumer Data Privacy are already pending, re­spec­tive­ly. Business owners are advised to put measures into place that allow them to adapt quickly to new or changing personal data re­quire­ments.

Click here for important legal dis­claimers.