Intro to the California Consumer Privacy Act (CCPA)

California Consumer Privacy Act

CCPA Compliance for Businesses

The California Consumer Privacy Act (CCPA) comes into effect on January 1, 2020.  Its provisions are focused on the protection of consumer privacy and will affect all companies dealing with consumer data in California.  Companies will be required to ensure that they have comprehensive compliance policies in place to protect both their business as well as their third parties, ie clients and vendors.

Definition

The CCPA is perhaps the most robust consumer privacy act ever passed by any US state. It gives all Californian consumers a right to:

  • Know what personal information a business is collecting
  • Access the data
  • Know whether that data is sold or shared
  • Refuse its sale
  • Have the data deleted or modified without discrimination

Key terms

Three key California Consumer Privacy Act (CCPA) terms defined in the legislation are:

  • Consumer
  • Business
  • Personal information

In the CCPA, “Consumer” means any non-temporary resident of the state, and is broadly described in the legislation as “a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations.”

A “Business” is likewise broadly defined as any for-profit enterprise that falls under any one of the following provisions:

  • Gross annual revenue over $25 million
  • Derives at least 50% of annual revenue from selling data
  • Annually buys, sells, shares or receives for commercial purposes, the personal information of 50,000 or more individual consumers, households or devices

The first two definitions include medium and larger businesses as well as all data brokers. The last, however, casts a wide net that will likely only widen over time.  For example, many Internet-savvy small businesses and tech start-ups could easily be included under this provision.  And yes, data collection also includes the use of web browser cookies that collect and share personal information.

Furthermore, any business that deals with the personal information of California residents is covered by the act, whether that business is based in California any other state jurisdiction in the US, or indeed, anywhere in the world.

“Personal Information” is also broadly defined as:

“Information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

This can include:

  • Identifiers (email, license, or IP address)
  • Geolocation or biometric data
  • Browsing history
  • Purchasing history
  • Education and work history
  • Commercial and financial data

Consumer benefits

The act gives the California consumer rights to the full disclosure of any and all personal information collected or purchased by any business they have dealings with. On request, any business must freely provide the consumer promptly with:

  • Collection categories relevant to that consumer’s personal information
  • All the specific data on that personal information
  • The data collection methods
  • The business purpose for the collection
  • Categories of all third parties selling, sharing or purchasing that information

As noted, the consumer then has the right to refuse sale and request modification or deletion. Their privacy rights will be enforced by the California Attorney General.

Business Compliance

Intentional violations of the California Consumer Privacy Act (CCPA) can attract fines of up to $7500 per violation. However, businesses have 30 days to address these. Data breaches can also attract claims of between $100 to $750 per incident.

Given the huge growth in data collection and sharing over the last decade, the potential for rapidly escalating fines and damages for privacy violations should be apparent. Doing business in California that deals in the collection of personal information in any form, will now require the development of consumer privacy policies that directly address the provisions of the CCPA.  Some examples include:

  • Develop clear privacy and data collection policies
  • Develop an organized database for reporting
  • Know the specific CCPA requirements for your business

The starting point for compliance begins with a clear CCPA privacy policy published on a business’s website for consumers to readily find.

This would generally be followed by data mapping to identify how a business collects and uses personal information, who the data belongs to, and with whom it’s shared or sold. This information would then be used to develop appropriate data management practices that allow for quick and easy database searches, in order to compile a consumer report detailing what personal information has been collected, at no cost to the consumer.

There are also specific requirements in the CCPA applying to some businesses that will, for example, require training customer relations staff in the privacy rights legislation, or providing top-level opt-out links on the website with the label “Do Not Sell My Personal Information.”

So here we go!  Starting this New Year’s Day, many businesses will be affected by the new CCPA. Small to medium-sized businesses will need to at the very least quantify how much Personal Information they collect and how they use it.  And well beyond the CCPA, developing a privacy policy for your business will future-proof it for the expansion of consumer protections around the world.

Reach out to Interactive Security today to learn more about how to prepare and protect your business in the brave new world of CCPA! We’re here to make it easy on you! www.intactsec.com

Interactive Security, Inc. has been at the forefront of providing industry leading expert information technology security services to clients across the globe – focused on IT Security Auditing & Compliance.

We pride ourselves on Making ~ IT COMPLIANCE OBTAINABLE, SIMPLE AND AFFORDABLE.

Vulnerability / Penetration Assessments ~ Application Security ~ PCI DSS ~ HIPAA ~ HiTRUST ~ ISO 27001 ~ FEDRAMP ~ FISMA/NIST ~ GDPR ~ Privacy Shield

Shawn Corrigan

Shawn Corrigan

Shawn Corrigan is the President and Founder of Interactive Security Holdings Inc. Interactive Security has grown into a global company offering IT Compliance Auditing services for small to large companies - focused on making it obtainable, simple and affordable. With over 20 years in the BPO and Financial industry working at the executive level, Corrigan has experienced the pitfalls, trials and tribulations of bringing an enterprise organization into IT compliance. Corrigan has designed a methodology geared at guiding clients of any size to successfully achieve compliance and ultimately obtain compliance certification. Corrigan is certified as a FISMA – NIST Implementor, PCI-DSS QSA, HiTRUST Certified Practitioner and HiTRUST Certified Quality Professional, ISO 27001 Lead Auditor and Implementor