The California Consumer Privacy Act (CCPA) is a data privacy law that provides California consumers with a number of privacy protections, including right to access, delete, and opt-out of the “sale” of their personal information. Since January 1, 2020, businesses that collect California residents’ personal information and meet certain thresholds (e.g., revenue, volume of data processing) will need to comply with these obligations. The California Privacy Rights Act (CPRA) is a data privacy law that amends and expands upon the CCPA. The law takes effect on January 1, 2023.
According to section 9 of CCPA, “businesses” that collect “consumer” data are subject to CCPA compliance. The CCPA will apply to for-profit businesses that collect and control California residents’ personal information, do business in the state of California which means “actively engaging in any transactions for the purpose of financial or pecuniary gain or profit”, and meet at least one of the following thresholds:
- Annual gross revenues larger than $25 million
- Receive or disclose the personal information of 50,000 or more California residents, households, or devices each year
- Make 50 percent or greater annual revenue from selling California residents’ personal information
- There is no minimum requirement of the employees.
- Smaller companies that don’t meet the revenue thresholds, and/or those that don’t traffic in large amounts of personal information from California residents, and don’t share a brand with an affiliate that’s covered by the CCPA.
- Anonymized Data
- Government Entities
- Possible applicability of other relevant federal privacy laws such as the Gramm-Leach-Bliley Act, the Fair Credit Reporting Actor the Health Insurance Portability and Accountability Act, that would exempt company from most of the CCPA’s provisions.
Currently, the CCPA extends to for-profit companies established in California (i.e., doing business in California) and entities that “indirectly” qualify as doing business (i.e., parents and subsidiaries of companies established in California). If a business transacts with California residents and meets threshold requirements, it’s also important to consider whether that business collects the personal information of California residents or consumers which does not cover deceased persons explicitly. Though “processing” is not defined within the statute or regulation, but similar activities are contemplated under the act. Notice is required to be given prior to collection but consent is not needed for processing. The scope of the CCPA is secured to the residency of the consumer as its purpose is to protect the rights of residents in California.
A business must show that they are protecting records that consumers agree to share with them. They must also stop collecting and sharing personal data when consumers decline or remove permission. According to the CCPA under Section 1798.140(o)(1), personal information is defined like Names, addresses, phone numbers etc.
Obligations of Controllers and Processors
- Record maintenance needed to cover what is collected
- Notice is to be given to the data subjects prior to collection
- No data protection officers are required
- Act requires maintaining records regarding satisfying requests
Compliances and Procedures
CCPA compliance primarily addresses four areas: access, user control, protection, and non-discrimination.
According to the CCPA, Data subjects are now entitled to the following rights:
- To know what personal information is being collected
- To know if their personal information is sold or disclosed, and to whom
- To say “no” to the sale of personal information (or say “yes” if between 13 and 16 years old)
- To access and delete personal information
- To equal service and price, even if they exercise their privacy rights
|NO.||OBLIGATION UNDER THECCPA||CORRESPONDING PROVISION UNDER CCPA||PARTYRESPONSIBLE FORCOMPLIANCE|
|1.||Transparency: The CCPA aims to give users greater access to the information that is collected from them. Consumers can now know how businesses treat and share that information. Therefore, creating a culture of transparency around consumer data. Under the CCPA, consumers may request that businesses disclose to them:Information collectedSources of the collected recordsBusiness purposes for collectionIf the business sells information, and for what purposeThird-party recipients of the files||Section 1798.110 and 1798.115 of the CCPA, 2018||Business Entities and Companies processing and selling data of the consumers.|
|2.||Access to Data:Business need to be willing to divulge the above information to the users within 45 days upon “verifiable request.” The information relayed should cover the last 12 months of data collection, sharing, use, and sale, as it applies to that consumer’s personal information. Here are CCPA requirements for businesses that collect consumer data:Let consumers know that data is collected.Allow consumers to opt-out and make privacy settings visible.Respond to consumer requests quickly.Double-verify identities of customers who want to check or delete their information.Tell the consumers what money you earn from data and what it is worth.Maintain records for two years.According to the CCPA text, a “verifiable consumer request” is a request made by a consumer, a consumer on behalf of a minor, or a person legally allowed to act on behalf of a consumer that addresses records verifiably collected from or about that consumer.||Section 1798.110 of the CCPA, 2018||Business Entities and Companies processing and selling data of the consumers.|
|4.||Non-Discrimination:A business shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights under the title. According to the California law, such actions include, but are not limited to:Denying goods or servicesCharging different prices (including the use of discounts, penalties, or price benefits)Offering a different quality of goods or servicesSuggesting that the consumer will receive differential prices or qualities if they exercise their rights||Section 1798.125 of the CCPA, 2018||Business Entities and Companies processing and selling data of the consumers.|
Non-Compliance under CCPA:
The CCPA provides for the following options for imposing liability in the event of non-compliance:
- Civil Penalties – Under Section 1798.155, in actions by the California Attorney General, businesses can face penalties of up to $7,500 per intentional violation or $2,500 per unintentional violation (but there is an opportunity to cure any alleged violation within 30 days after receiving notice of the alleged violation).
- Damages – Under Section 1798.150, in actions brought by California consumers and Attorney General for security breach violations, consumers may recover statutory damages not less than $100 and not greater than $750 per consumer per incident or actual damages, whichever is greater. In actions for statutory damages, consumers must first provide businesses with written notice and an opportunity to cure.
- Non-Monetary Relief – In actions brought by consumers for security breach violations, consumers may seek injunctive or declaratory relief, as well as any other relief the court deems proper.
- Businesses may also besubject to an injunction in actions brought by the Attorney General.
- All the penalties are sent to the consumer privacy fund
In addition to expanding the types of data protected, the CPRA creates new rights, including the right to rectification, where the consumer has more power to correct inaccurate information. Furthermore, the new right to restriction gives consumers the ability to limit the use and disclosure of sensitive data.
For businesses, the law will change the threshold of 50,000 customers to 100,000 customers. Businesses also get a trade secrets exemption.
The California Privacy Rights Act of 2020 (CPRA) will create a broader range of individual privacy rights, including adding the right to correction and expanding the right to delete. In addition, businesses must now notify third parties who access the data to delete it as well.
This new law also protects “sensitive data,” a new category. Sensitive, personally identifiable information distinguishes between information marked “sensitive” and information that is not.
Sensitive data includes:
- Race, ethnicity, religion
- Biometrics, health, sex life
- Content of mail, email, and text messages
- Debit and credit card numbers and login data
- Audio, electronic, visual, or thermal information
- Inferences drawn from this information to create consumer profile recording preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes
The CPRA created a new agency, the California Privacy Protection Agency (CPPA), to oversee consumer privacy. The CPRA allows the agency to:
- Fine businesses that don’t comply with the law
- Hold hearings
- Clarify and answer questions about the privacy guidelines
- One major complaint about the CCPA is that a lot of the details of the law were vague and open to interpretation. The CPRA clarifies many existing points within the CCPA. It also created the CPPA and gave them the power to clarify the law and its regulations. This agency also has the power to update privacy laws as circumstances change.
Other changes include:
- Coverage of sharing (not only selling) information
- Greater protections for children
- Privacy rights for employees and independent contractors
- Bar on businesses’ future attempts to avoid the law, enforceable by the CPPA
- Removal of the 30-day time period for businesses to fix problems
- Limits to the legislature’s ability to make amendments to the law
- Changes many definitions under the law
- Exempts publicly available information
- Brings “contractors,” people who buy and use information, under the law with reporting requirements.
- Web browsers must recognize Global Privacy Signals (GPC)
- Data inventories and PIA (Privacy Impact assessment) are required
There were various changes made to the CPRA with respect to CCPA which can be shown as below and what can be done to comply to those various changes introduced under CPRA:
|NO.||CHANGES UNDER THECPRA||CORRESPONSING PROVISION UNDER CPRA||WHAT CAN BE DONE?|
|1.||Scope of Personal Data: Under CCPA employee and B2B data was temporarily exempted. But now privacy related requirements will now apply to this data as similar to consumer data under CPRA.||Scope of the CPRA||Companies must review their entire data processing activities and apply privacy policies and data processing contracts to employee and B2B personal data as well.|
|2.||Thresholds for applicability:CPRA has introduced changes in thresholds for application of law, which will apply to all entities doing business in California. Wherein the entity now handles the personal information of 100,000 or more consumers or households under CPRA.||Section 1798.140(d) of the CPRA, 2020||Entities should map their data processing activities to determine whether the activities expose them to scope of CPRA or not.Companies should make data protection planning strategically if they wish to be bound under the CPRA voluntarily.|
|4.||Privacy Principles:CPRA introduced a few new privacy principles which were not included in the CCPA which includes:Purpose LimitationStorage LimitationSecurity Measures’Audits and Risk Assessment||Section 1798.185(a)(15) which provides for audit obligation under CPRA, 2020||Companies should map their data processing activities in order to determine the purpose of the collection.Companies should update their policies and procedures for the retention and destruction of the personal information.Conduct an annual cybersecurity audit. This can be done by the companies which process sensitive personal information.|
|5.||Data Sharing: Under the CPRA, Businesses will be required to enter into written contractual agreements with entities who receive personal information from the Business. This requirement will also apply with respect to “Contractors” under the CPRA which is a newly defined term and other Service Providers. Also, such entities need to bind their subcontractors to the same written terms and notify the Business of any engagements with a new subcontractor and need to adhere CPRA requirements.||Section 1798.185(11) of the CPRA, 2020||Companies should review and update their engagements with the service providers and implement applicable and adequate contractual guarantee as required under the CPRA.|