GDPR or the European Union’s General Data Protection Regulation effectively altered the way that businesses interact with European citizens. It doesn’t matter whether a company is located within the boundaries of Europe or not — if it does business with citizens protected by the regulation it must follow the set guidelines.
You could say it threw quite the curveball at the business world as it continues to ruffle up a few feathers. Well, that’s about to happen again thanks to California’s Consumer Privacy Act.
Despite being passed in June 2018, the bill doesn’t go into effect until January 2020. Like GDPR, that gives businesses time to prepare and ensure they are compliant. It’s likely, however, that many are not ready for what it entails.
As the name implies, CCPA or the California Consumer Privacy Act is designed to protect the rights of California citizens when it comes to digital content and data. It deals with the collection, storage, security and sharing of all consumer-related information.
The bill allows consumers to request access to all the information a business has collected about them. More specifically, businesses must disclose what categories and pieces of information they have, how they acquired said information, what they use it for and who they shared with. In addition, the sharing and selling of information for business purposes must be identified and explained in full.
Moreover, businesses must purge data upon request, provide controls or opportunities to do this to its customers, and direct third-parties to delete the personal records and information too.
The simple description above doesn’t necessarily outline the obligations and requirements of the average business, so here they are broken down in more detail.
Businesses must do the following:
The next question is what companies this regulation applies to. For CCPA to apply, businesses that operate in California directly or collect personal information from its residents — even outside the state — their devices or their households, these criteria must be met:
Furthermore, it should be noted that just because a business is prepared for or in compliance with GDPR does not mean they are automatically doing so for CCPA. There are similarities, but they are two different regulations and should be treated as such.
Businesses have a period of 45 days to respond to consumer requests for data. In addition to disclosing information and providing deletion opportunities, a business must allow consumers to opt-out of data collection processes beforehand.
For non-compliance and violations, consumers can sue the business for any wrongdoing, and further fees and monetary fines may incur too. Therefore, non-compliance can be incredibly damaging to affected businesses.
The reality is that most companies are not ready for this regulation to go into effect. But it certainly won’t be the last as more pressure is put on policymakers to protect the rights of consumers in the wake of cybersecurity threats and many wrongful applications of personal information.
The state of Georgia, for example, is working on a similar bill that will protect its residents. It won’t be long before other states and municipalities follow suit. Other countries started to weigh the idea, India serving as the prime example.
It is long overdue in many cases and will force businesses to handle consumer information and content properly. But it’s also coming much faster than perhaps anyone expected, which unfortunately means many companies will be unprepared.
It’s likely we will see a wave of non-compliance and violation proceedings as a result, at least over the next few years.
By Kayla Matthews
