Top 5 Things to Know About the California Consumer Privacy Act of 2018 (CCPA)
by Alex Gorton
On June 28, 2018 California enacted the California Consumer Privacy Act of 2018 (CCPA). This legislation gives consumers rights to control how their personal data is collected and used.
- The CCPA goes into effect on January 1, 2020
Although the law doesn’t go into effect until January 1, 2020 the CCPA requires companies to adhere to practices that might take time to implement. Any business that might be affected by the CCPA should begin to review requirements and adjust its policies accordingly.
- The CCPA effectively grants California residents 5 rights
Under the CCPA consumers (aka California residents) are granted the right to
- know what personal information a company is collecting and how the information will be used before or at the point a company collects the personal information
- access a copy of the “specific pieces of personal information” that a business has collected about that consumer
- deletion of a consumer’s personal information
- opt out of the sale of a consumer’s personal information to third parties
- not be discriminated against because the consumer exercised any of the consumer’s rights
- Personal Information includes individuals and households
Under the CCPA, “personal information” is any information that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”
- Businesses must comply with the CCPA if
- The business collects personal information relating to California residents
- The business determines the purposes and means of processing the personal information
- The business does business in California and
- The business meets one of the following thresholds
- Has annual gross revenues in excess of $25 million
- Annually buys, receives for its commercial purposes, sells or shares for commercial purposes personal information relating to 50,000 or more consumers, households or devices
- Derives 50% or more of its annual revenue from selling consumer personal information
- The CCPA permits a private right of action for violations of consumer’s rights under the CCPA.
The CCPA permits a private right of action for unauthorized access, theft, or disclosure of personal information in certain situations with possible damage awards of $100 to $750 per consumer and per incident, or actual damages, along with other types of relief.
January 27, 2020