Amidst recent scandals and breaches in large tech giants, the California legislature has passed the nation’s strictest data privacy law which will allow consumers to have control over their personal data The California Consumer Privacy Act of 2018 (CCPA), which passed on June 28, 2018, will go into effect on January 1, 2020. The Act is similar to, but not as restrictive as the European Union’s General Data Protection Regulation (GDPR), and provides consumers a variety of rights with regard to how covered businesses use their personal data. These new rights include:
– Right of Access – a consumer will have the right to request businesses that collect personal information to disclose to the consumer the categories and specific pieces of personal information the business has collected
– Right of Deletion – a consumer will have the right to request that the business delete any personal information that was collected
– Right to Know – a consumer will have a right to know if his or her personal information was sold or disclosed and to whom, which includes sale or disclosure to third parties
– Opt-in and opt-out consent – a consumer can opt out of having his or her data sold to third parties, although the law will allow business to offer incentives to consumers who continue to opt-in
– Children under age 16 must opt-in to allow companies to collect their information at all
The new law implicates a business that collects consumers’ personal information by itself or jointly with others, conducts business in California, and meets one or more of the following: (1) has annual gross revenues in excess of twenty-five million dollars ($25,000,000); (2) alone or in combination, annually buys, receives for the business’ commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices; or (3) derives 50% or more of its annual revenues from selling consumers’ personal information.
The CCPA also gives the California Attorney General more authority to fine companies who do not comply with the new law. The full text of the bill can be found here.
Impact on Business. Naturally, like most measures impacting the collection and use of consumer data, the Act will have important consequences for covered businesses. The lawyers of Santomassimo Davis LLP can help you understand the impact on your particular business.