CCPA COMPLIANCE

The Business Blocks

What does the CCPA abbreviation mean? AKA the California Consumer Privacy Act (CCPA), it is a digital consumer protection law that covers four major areas: first, the right to know what businesses are doing with their information, second, the right to have information held by firms deleted, third, the right to opt-out of the sale of personal information, and fourth, the right to be treated fairly when exercising their CCPA rights.

According to its provisions, the California Consumer Privacy Act is the nation’s most comprehensive privacy legislation. As stated in the bill’s goals, it will offer citizens more significant influence over how their personal information is stored and used while also introducing ground-breaking data protection.

What Is CCPA Compliance?

The California Consumer Privacy Act (CCPA), the first comprehensive data privacy legislation in the United States, was effected in 2020. California legislators enacted a new set of legislation in 2018 to establish controls on how organizations acquire, keep, and sell the personal data of California citizens.

The law became effective on January 1, 2020. However, the unfortunate fact is that most businesses are still not complying with all of the new requirements.

The California Consumer Privacy Act provides the following rights to its residents:

  • Businesses are obligated to disclose any personally identifiable information about a customer acquired, sold, or released for a commercial purpose. Furthermore, companies must tell customers about the types of personal data they will gather and the purposes for which they will use their data.
  • Having access to their personal information.
  • Upon receiving a request, an organization is required to erase all of the consumer’s personal information. If this information is shared with third-party suppliers, it is necessary to remove the data stored in those vendors’ systems.
  • The opportunity to refuse the sale of their data if they so want. Businesses must offer easy-to-use links to this functionality on their websites as part of this requirement.

The CCPA prohibits businesses from discriminating against customers who exercise their rights under the law.

Which Businesses Are Required to Adhere to the CCPA?

Some businesses believe the California Consumer Privacy Act of 2018 (“CCPA”) does not apply to them since they do not have a California storefront or office. Mistakes like these can lead to regulatory investigations and fines.

No actual presence in California is required. It may apply to your business if you are situated outside of California yet conduct business with Californians for profit. Unless one of the three criteria in the legislation is not met, the CCPA likely applies to your business if you collect any information from California residents, such as through an internet website.

Anyone doing business in Canada who fulfills one or more of the following criteria:

  • Over $25 million in annual gross sales
  • The company sells or gets personal information about 50,000 or more Californians.
  • Individual information sales account for 50% or more of annual income.

The CCPA does not govern business activity outside of California. Today, however, it is not unusual for commercial activity to occur outside of the nation’s most populated state. Suppose you run a for-profit website that gathers information on California residents (such as IP addresses). In that case, you should assess if you satisfy any of the CCPA’s requirements and develop a compliance strategy.

Even firms that do not satisfy one of the CCPA’s standards may be subject to regulation. No matter how much money a firm makes, if it has common branding with a competitor, it must comply with the CCPA.

In summary, a company’s absence from California does not exclude it from the CCPA’s reach. To be covered by the CCPA, your company must either satisfy one of the law’s standards or share branding with one that does.

Who or What Is in Charge of Enforcing CCPA Compliance?

The California Consumer Privacy Act, which took effect on June 28, 2018, establishes a slew of consumer privacy rights and corporate duties related to collecting and selling personal information. The CCPA became law on January 1, 2020. Enforcing the CCPA is the responsibility of the California Attorney General’s office. On July 1, 2020, law enforcement began.

What Is the Importance of CCPA for Your Business?

The Business Blocks

The CCPA will be highly beneficial to its consumers. They will have tremendous control over their data.

Consumers will have the right to view all data collected about them by businesses. They will be allowed to access this data twice a year without fear of reprisal from corporations. This enables customers to make informed decisions about sharing their data with businesses, increasing their peace of mind.

Additionally, consumers will have the option to opt out of having their data sold if they disagree with the data collection on them. Additionally, users can request that their data be deleted and expect their wishes to be followed, including anything posted online. Individuals who post on social media as teenagers and later regret as job-seeking adults may have their posts deleted. Their past decisions do not have to sully their public image; they have the option of deleting such posts.

If companies collect personal information about their customers and the information is stolen, consumers will have the right to sue, aiding businesses in preventing identity theft. Companies will be more open to safeguarding data from hackers if they know that they may face legal action when disclosing sensitive consumer information. Additionally, no data about opt-out users may be collected at all. There is an extra layer of protection for children under the age of 16: they must consent to manage their data in the first place. CCPA protects children by increasing their privacy.

In general, the CCPA promotes more transparency between businesses and their customers. Companies must be honest about the data they collect and why they collect it. An individual cannot sell personal information without the consumer’s consent.

What Are the Rules of CCPA?

The CCPA safeguards an individual’s and business’s data.

 In terms of what constitutes “personal information,” the word is generally defined as “information that identifies, refers to, characterizes, is capable of being connected with, or may reasonably be associated with, a specific California citizen or household.” The term “personal information” encompasses the following:

  • Personal identifiers, such as a given name, an alias, a postal address, a unique personal identifier, an IP address, and email address, the name of an account, a social security number, a driver’s license number, or a passport number;
  • Commercial data, such as records of personal property, items or services purchased, received, or contemplated, as well as other purchasing or consumption histories or trends;
  • Internet or other electronic network activity information, such as browsing history, search history, and information on a California resident’s engagement with a website, application, or advertisement;
  • Geospatial information;
  • Biometric data;
  • Information that is audible, electrical, optical, thermal, olfactory, or similar;
  • information about one’s professional or job status; and
  • Education-related data.

A “consumer” is a natural person (not a legal entity such as a corporation) who is a resident of California, which includes any individual who is in the state for any purpose other than temporary or transitory, or any individual who is domiciled in the state but is traveling outside the state for a temporary or transitory purpose. The term is extensive, which appears to include citizens of California who travel to other states.

What Are the CCPA Penalties?

Civil fines are the means through which organizations can be held responsible for CCPA violations.

Under the CCPA, the Attorney General’s Office of California has been granted sole authority to file civil proceedings to enforce the statute. Several instances of infractions that may subject businesses to civil fines include the following:

  • Inadequately enforcing a CCPA-compliant privacy policy
  • Failure to react to customers’ CCPA rights demands
  • Inadequate notification when collecting personal information
  • Without offering an opt-out mechanism, selling consumers’ personal information
  • Discriminating against customers who use their California Consumer Protection Act (CCPA) rights

On the other side, the CCPA provides consumers with the private right of action – the opportunity to sue an organization and bring civil legal claims against them for breaking the law. However, it is critical to remember that under the CCPA, consumers have a private right of action only when their unencrypted or unredacted personal information is compromised, not for any other violation of the law.

The CCPA requires firms to get a 30-day notice before facing a CCPA violation action.

Businesses have 30 days from receipt of the notification to address and repair the infringement. They may submit a declaration to the California Attorney General or the aggrieved consumer confirming that the infraction has been remedied to entirely avoid the statutory civil penalty.

However, complying with a penalty is easier said than done, and it may prove operationally tricky for businesses to properly fulfill hundreds of pending DSRs within a strict 30-day time period. It may even be impossible in some cases, such as when consumers’ personal information is compromised and used for identity theft fraud.

The Business Blocks

Elements of an Effective CCPA Compliance Program

1. Determine if your business is subject to the CCPA.

If your business meets one of the three jurisdictional thresholds (+$25 million in annual gross revenue; acquires, receives, shares, or sells personal information from more than 50,000 California residents; or generates more than 50% of annual revenue from the sale of personal data) and is a for-profit entity that collects personal information from California residents and controls how it is used (directly or indirectly), you are likely subject to the law.

2. Maintain current knowledge of any updates or amendments to the CCPA.

Ascertain that your firm remains compliant with the new law. This may involve monitoring relevant legislation or technical modifications that may modify the statute’s scope and any new implementing rules adopted by the California Attorney General.

It is also prudent to visit the California Attorney General’s CCPA homepage or regularly subscribe to its CCPA email list for any new clarifications to the law and regulations.

3. Examine the CCPA’s exclusions to determine if your firm is eligible.

As is the case with most significant legislations, the CCPA has sufficient exemptions and exclusions to make it worthwhile to determine if your firm is exempt, mainly if you operate in the healthcare or financial services industries. In all situations, consult professionals before presuming if your firm is required to comply or not.

4. Conduct a review of your data security processes and policies.

Conduct a thorough data security risk assessment for any California consumer data that your firm currently manages to ensure that this data is protected correctly. As part of your security system assessment, identify and resolve any technological system constraints, including how your systems identify California citizens.

On January 1, 2020, the CCPA’s private right of action for certain data breaches became effective. Practical and comprehensive security procedures can serve as formidable barriers against such acts.

5. Examine your current company processes to prepare for CCPA compliance.

Consider your data streams – most notably the information received from consumers – and ask yourself some critical questions. How does your firm gather, track, and store data about its customers? How is data shared, and who has access to it?

More precisely, does your firm sell, reveal, or exchange personal information about your consumers with third parties? And if your firm does participate in this activity, examine whether selling or trading personal information about California residents is necessary for your organization’s fundamental operations or if it could function well without it.

6. Comply with the CCPA’s disclosure requirements

The CCPA compels companies to make thorough disclosures to California citizens about acquiring and utilizing their personal information. Ascertain that your firm has implemented such disclosures. Additionally, update any earlier privacy-related disclosures to comply with CCPA standards, and establish procedures to guarantee that such disclosures are updated at least once a year.