Kayla Matthews

The California Consumer Privacy Act: What You Should Know

The California Consumer Privacy Act

GDPR or the European Union’s General Data Protection Regulation effectively altered the way that businesses interact with European citizens. It doesn’t matter whether a company is located within the boundaries of Europe or not — if it does business with citizens protected by the regulation it must follow the set guidelines.

You could say it threw quite the curveball at the business world as it continues to ruffle up a few feathers. Well, that’s about to happen again thanks to California’s Consumer Privacy Act.

Despite being passed in June 2018, the bill doesn’t go into effect until January 2020. Like GDPR, that gives businesses time to prepare and ensure they are compliant. It’s likely, however, that many are not ready for what it entails.

What Is the Consumer Privacy Act?

As the name implies, CCPA or the California Consumer Privacy Act is designed to protect the rights of California citizens when it comes to digital content and data. It deals with the collection, storage, security and sharing of all consumer-related information.

The bill allows consumers to request access to all the information a business has collected about them. More specifically, businesses must disclose what categories and pieces of information they have, how they acquired said information, what they use it for and who they shared with. In addition, the sharing and selling of information for business purposes must be identified and explained in full.

Moreover, businesses must purge data upon request, provide controls or opportunities to do this to its customers, and direct third-parties to delete the personal records and information too.

What Are the Business Obligations?

The simple description above doesn’t necessarily outline the obligations and requirements of the average business, so here they are broken down in more detail.

Businesses must do the following:

  • Provide opportunities to request details about personal records and data, along with controls to purge said data.
  • Disclose, in full, the pieces and datasets of information that the business has collected and stored.
  • During or before collection, businesses must inform consumers about what they gather and why.
  • Upon request, all stored data must be disclosed, for free, no more than twice in a 12-month period.
  • Retain personal information collected only for a single, one-time transaction if it is not sold or stored — data must be purged completely afterward.
  • Reidentify, link or disclose additional data that, in the usual course of business, is not maintained in the same manner as personal information.
  • Opt-out opportunities should be made available to prevent the collection of personal information before service is rendered.
  • All consumers have a right to equal service and pricing even if they exercise their privacy rights and decline data collection.

The next question is what companies this regulation applies to. For CCPA to apply, businesses that operate in California directly or collect personal information from its residents — even outside the state — their devices or their households, these criteria must be met:

  • Businesses that have annual gross revenue exceeding $25 million.
  • Any company that buys, sells or shares the personal information of 50,000 consumers, households or devices annually.
  • Businesses that earn 50% or more revenue as a result of selling customer information.

Furthermore, it should be noted that just because a business is prepared for or in compliance with GDPR does not mean they are automatically doing so for CCPA. There are similarities, but they are two different regulations and should be treated as such.

What Happens With Non-Compliance?

Businesses have a period of 45 days to respond to consumer requests for data. In addition to disclosing information and providing deletion opportunities, a business must allow consumers to opt-out of data collection processes beforehand.

For non-compliance and violations, consumers can sue the business for any wrongdoing, and further fees and monetary fines may incur too. Therefore, non-compliance can be incredibly damaging to affected businesses.

The reality is that most companies are not ready for this regulation to go into effect. But it certainly won’t be the last as more pressure is put on policymakers to protect the rights of consumers in the wake of cybersecurity threats and many wrongful applications of personal information.

The state of Georgia, for example, is working on a similar bill that will protect its residents. It won’t be long before other states and municipalities follow suit. Other countries started to weigh the idea, India serving as the prime example.

It is long overdue in many cases and will force businesses to handle consumer information and content properly. But it’s also coming much faster than perhaps anyone expected, which unfortunately means many companies will be unprepared.

It’s likely we will see a wave of non-compliance and violation proceedings as a result, at least over the next few years.

By Kayla Matthews

THOUGHT LEADERS

Or Lenchner

Using an IPPN to fight ad fraud: your questions, answered

Using an IPPN to fight ad fraud It’s a well-known fact: the internet is a marketer’s dream, offering brands the chance to engage with consumers ...
David Gevorkian

How to Apply Website Accessibility in UX and How to Achieve Better User Experience

Design Tweaks: Apply Website Accessibility in UX In this current digital age, websites have become more complex because of the introduction of various aesthetic designs ...
Ronald Van Loon

Faster Innovation and Development with a Full-Stack AI Strategy

Full-Stack AI Strategy The future is here and companies that have incorporated the latest innovations led by AI in their business processes are reaping the ...
Jim

The Key To Improving Business Lies In Eye-Interaction Tech

Eye-Interaction Technology Analysts at Goldman Sachs predict virtual reality revenue will surpass TV within the next decade. More than just some gaming fad, VR represents ...
Andy Golyps

The UK Tech Sector: The Gender Gap

The Tech Sector Gender Gap In conversation with Co-Founder and Creative Director of North West Web Design Studio, MadeByShape Andy Golpys discusses: The UK Tech ...
Katie Cullen Montgomerie

Is There Still A Place For On-premise Migration Tools

On-premise Migration Tools With the popularity of cheap and convenient online migration tools, it’s hard to imagine why there would still be a need for ...

Cloud Community Supporters

Isc2 Logo
Aws
Hp
Ca
Cisco Logo

Cloud community support comes from sponsorship, service opportunities and collaborative network partnership initiatives.