The California Consumer Privacy Act: What You Should Know

The California Consumer Privacy Act

GDPR or the European Union’s General Data Protection Regulation effectively altered the way that businesses interact with European citizens. It doesn’t matter whether a company is located within the boundaries of Europe or not — if it does business with citizens protected by the regulation it must follow the set guidelines.

You could say it threw quite the curveball at the business world as it continues to ruffle up a few feathers. Well, that’s about to happen again thanks to California’s Consumer Privacy Act.

Despite being passed in June 2018, the bill doesn’t go into effect until January 2020. Like GDPR, that gives businesses time to prepare and ensure they are compliant. It’s likely, however, that many are not ready for what it entails.

What Is the Consumer Privacy Act?

As the name implies, CCPA or the California Consumer Privacy Act is designed to protect the rights of California citizens when it comes to digital content and data. It deals with the collection, storage, security and sharing of all consumer-related information.

The bill allows consumers to request access to all the information a business has collected about them. More specifically, businesses must disclose what categories and pieces of information they have, how they acquired said information, what they use it for and who they shared with. In addition, the sharing and selling of information for business purposes must be identified and explained in full.

Moreover, businesses must purge data upon request, provide controls or opportunities to do this to its customers, and direct third-parties to delete the personal records and information too.

What Are the Business Obligations?

The simple description above doesn’t necessarily outline the obligations and requirements of the average business, so here they are broken down in more detail.

Businesses must do the following:

  • Provide opportunities to request details about personal records and data, along with controls to purge said data.
  • Disclose, in full, the pieces and datasets of information that the business has collected and stored.
  • During or before collection, businesses must inform consumers about what they gather and why.
  • Upon request, all stored data must be disclosed, for free, no more than twice in a 12-month period.
  • Retain personal information collected only for a single, one-time transaction if it is not sold or stored — data must be purged completely afterward.
  • Reidentify, link or disclose additional data that, in the usual course of business, is not maintained in the same manner as personal information.
  • Opt-out opportunities should be made available to prevent the collection of personal information before service is rendered.
  • All consumers have a right to equal service and pricing even if they exercise their privacy rights and decline data collection.

The next question is what companies this regulation applies to. For CCPA to apply, businesses that operate in California directly or collect personal information from its residents — even outside the state — their devices or their households, these criteria must be met:

  • Businesses that have annual gross revenue exceeding $25 million.
  • Any company that buys, sells or shares the personal information of 50,000 consumers, households or devices annually.
  • Businesses that earn 50% or more revenue as a result of selling customer information.

Furthermore, it should be noted that just because a business is prepared for or in compliance with GDPR does not mean they are automatically doing so for CCPA. There are similarities, but they are two different regulations and should be treated as such.

What Happens With Non-Compliance?

Businesses have a period of 45 days to respond to consumer requests for data. In addition to disclosing information and providing deletion opportunities, a business must allow consumers to opt-out of data collection processes beforehand.

For non-compliance and violations, consumers can sue the business for any wrongdoing, and further fees and monetary fines may incur too. Therefore, non-compliance can be incredibly damaging to affected businesses.

The reality is that most companies are not ready for this regulation to go into effect. But it certainly won’t be the last as more pressure is put on policymakers to protect the rights of consumers in the wake of cybersecurity threats and many wrongful applications of personal information.

The state of Georgia, for example, is working on a similar bill that will protect its residents. It won’t be long before other states and municipalities follow suit. Other countries started to weigh the idea, India serving as the prime example.

It is long overdue in many cases and will force businesses to handle consumer information and content properly. But it’s also coming much faster than perhaps anyone expected, which unfortunately means many companies will be unprepared.

It’s likely we will see a wave of non-compliance and violation proceedings as a result, at least over the next few years.

By Kayla Matthews

Rakesh Soni
Multi-tenant clouds are becoming more popular than ever because they're incredibly cost effective and easy to set up. If you're considering switching your business over to a multi-tenant cloud platform, this article is for you ...
JK Chelladurai
Usage-Based Pricing We are now in an era where many businesses are flipping their business model and shifting from subscription-based pricing to usage-based models, to better cater to the modern ‘pay-as-you-consume’ buyer. So what exactly ...
Gary Bernstein
Test Data Management How do you test your data management systems? With Delphix, you can automate your tests by running your data against a virtual copy of your production environment. Today, the amount of data ...
Louis
Real-time Enterprise Software Data Enterprise software startups are capitalizing on real-time data to continually improve revenue, costs, cash flow, marketing, and sales as their business grows. The majority of software startup CEOs spoken with have ...
Gilad David Maayan
Cloud Security Posture Management Cloud Security Posture Management (CSPM) enables you to secure cloud data and resources. You can integrate CSPM into your development process, to ensure continuous visibility. CSPM is particularly beneficial for DevOps ...

SECURITY TRAINING

  • Isc2

    ISC2

    (ISC)² provides IT training, certifications, and exams that run online, on your premises, or in classrooms. Self-study resources are available. You can also train groups of 10 or more of your employees. If you want a job in cybersecurity, this is the route to take.

  • App Academy

    App Academy

    Immersive software engineering programs. No experience required. Pay $0 until you're hired. Join an online info session to learn more

  • Cybrary

    Cybrary

    CYBRARY Open source Cyber Security learning. Free for everyone, forever. The world's largest cyber security community. Cybrary provides free IT training and paid IT certificates. Courses for beginners, intermediates, and advanced users are available.

  • Plural Site

    Pluralsite

    Pluralsight provides online courses on popular programming languages and developer tools. Other courses cover fields such as IT security best practices, server infrastructure, and virtualization.