Risk Management Blog

The California Consumer Privacy Act (CCPA), a comprehensive consumer protection law that redefines what is considered personal information and how that information is handled, took effect January 1, 2020, impacting companies doing business in the Golden State. Text of the CCPA can be found here.

The CCPA places new requirements on a wide range of businesses that interact with the personal information of Californians regarding the collection, use and sharing of that personal information.

Here is a link to Relaw APC’s December newsletter that gives a brief overview of the CCPA, what businesses are impacted and how, with a brief excerpt below.

If one or more of the following are true, businesses must comply:

1. Has gross annual revenues in excess of $25 million;
2. Buys, receives, or sells the personal information of 50,000 or more consumers, households, or devices; or
3. Derives 50% or more of annual revenues from selling consumers’ personal information

Businesses subjected to the CCPA regulations must provide notice to customers before data collection and create procedures for consumers to opt-out, know and delete. Businesses must respond to requests from consumers in a specified timeframe and once a request is made, they must verify the consumer and make records.

Here is a link to the Privacy Law Blog at the law firm Proskauer Rose LLP that provides deeper discussion on the CCPA, its origins and impacts, with a brief excerpt below.

What are the Act’s major provisions?

The Act gives “consumers” (defined as natural persons who are California residents) four basic rights in relation to their personal  information:

1. the right to know, through a general privacy policy and with more specifics available upon request, what personal information a business has collected about them, where it was sourced from, what it is being used for, whether it is being disclosed or sold, and to whom it is being disclosed or sold;

2. the right to “opt out” of allowing a business to sell their personal information to third parties (or, for consumers who are under 16 years old, the right not to have their personal information sold absent their, or their parent’s, opt-in);

3. the right to have a business delete their personal information, with some exceptions; and

4. the right to receive equal service and pricing from a business, even if they exercise their privacy rights under the Act.

It’s a brave new world out there.