California Consumer Privacy Act — 79 Days Until the CCPA Goes into Effect

The CCPA goes into effect in 79 days! For some of you, this day will come all too soon, and it is a lot to think about. We are thinking about it too. In fact, many of our clients have been asking how this will impact them.

They asked — we listened.

We thought it would be beneficial to put together a short Frequently Asked Questions (FAQ) document about the CCPA. This is by no means an exhaustive list, but it will ready your team to review your own applications. We anticipate more information and clarity as we approach January 1st. I encourage you to do your own research if you are a business operating in California, or are conducting business with clients living in California. Below you will find more information specific to who this will impact, but in my opinion, it will be affecting everyone — Nationwide — and soon.

What is the CCPA?

The CCPA stands for California Consumer Privacy Act. It is a bill that is intended to increase privacy rights and consumer protection for residents of California, USA. Amendments to the CCPA were passed on September 13, 2018.

When does the CCPA go into effect?

The CCPA becomes effective on January 1, 2020.

Will there be any changes before it goes into effect?

Potentially, yes. There is currently a document of Proposed Regulations. The Attorney General is accepting written comments until December 6th, 2019.

Who must comply with the CCPA?

Anybusinesses operating in California that collect personal information about its consumers that meets any of the three statements:

• Has annual gross revenues in excess of $25 million;
• Possesses the personal information of 50,000 or more consumers, households, or devices; or
• Earns more than half of its annual revenue from selling consumers’ personal information.

Can this affect me if my business is not physically present in California?

Yes The CCPA does not require you to be present in California. It will affect you if you are conducting business with California residents and have the following:

• Annual gross revenues in excess of $25 million;
• Possesses the personal information of 50,000 or more consumers, households, or devices; or
• Earns more than half of its annual revenue from selling consumers’ personal information.

What if my business does not comply?

Failure to comply will result in the maximum civil penalty of $7,500 per violation, per individual if the business intentionally violates it. Otherwise, the max penalty is $2,500 per violation, per individual.

What is on the horizon for other states in the USA?

Roughly about 10 other states are purposing a similar law to the CCPA. Hawaii, Maryland, New York, and Washington, to name a few, with Maine recently passing. This means you will need to comply in each jurisdiction if this happens.

How can my company comply?

1. Notify consumers about data collection. Businesses must inform individuals what information is being collected about them. You need to do this before or at the time of collection.
2. Prepare for access requests. Consumers may request a record of what collected information, where it came from, how it was used. Consumers can also ask which third parties received a copy of the data. According to the Proposed Regulations, businesses must provide two or more designated methods for submitting a request.
3. Allow consumers to opt-out. Under this new law, consumers may opt-out of sharing personal information. A business cannot ask a consumer to change their choice for a period of 12 months.
4. Consider Minors. Minors under 13 years old require their parents’ consent for their data to be sold. Minors 13 to 16 can opt-in themselves.

For more details, see the Proposed Regulations, but remember these may be subject to change.

We hope this has been helpful. We try to look out for our clients on matters that will be impacting them. Do not hesitate to reach out if you have any further comments or questions.