The California Consumer Privacy Act: Are you #InTheKnow?

​Governor Jerry Brown signed the California Consumer Privacy Act (CCPA) last year in June 2018.  Like the General Data Protection Regulation (GDPR), the privacy framework provided by the European Union (EU), the CCPA broadly increases the rights of those individuals who visit your website or download app, providing you with their personal information.  It requires far more transparency about how you, as a business, collect, use, and disclose their personal information.

The deadline for all companies to comply is January 1, 2020.  The cost of noncompliance can be high -- fines of up to $7,500 per violation.  Furthermore, under the CCPA, consumers may bring private actions for statutory damages.

We previously wrote about the GDPR here and here.  For those of you wondering where the GDPR and CCPA overlap versus where they differ, we provide the following guidance on a few key differences below.  

Please note, this list is not exhaustive and you should consult an attorney to determine your compliance with both statutory frameworks.

1. Location does not matter.  Even if your business is not located in the EU or California, you have to comply with the GDPR if your business processes data of EU subjects, and/or comply with the CCPA if your business collects data of California residents.  Since most companies do not restrict their website visitors or mobile app downloads by geolocation fences to avoid access by EU or California residents, it is likely that compliance is necessary.
2. Being a “small fry” helps.  The CCPA only applies to businesses that earn $50,000,000 a year in revenue, sell 100,000 consumer’s records each year, or derive 50% of their annual revenue by selling personal information.  See: https://www.caprivacy.org/facts/hold-big-corporations-accountable  
3. You have to include a link to opt out on your website/app.  For those of you who: (1) have to comply (see Nos. 1 and 2 above) and (2) sell personal data of visitors to your website or downloaders of your mobile app; you will have to include a link that allows consumers to opt-out of allowing you to sell their personal data.  Note, the GDPR only allows consumers to withdraw their consent allowing you to transfer their data for secondary purposes. The link is an additional consumer-friendly requirement imposed by the CCPA.
4. You have to, at the very least, be ready to provide 12 months of data upon request.  Under the GDPR, a consumer could theoretically request any and all personal data you have collected and processed from his or her use of your website or app over the years.  Under the CCPA, however, the consumer could only, in theory, request personal data submitted to you within the last year. There is also a marked difference between a request for data that you sold, versus data that you merely transferred.

As a result of the CCPA, companies will need to consider the following issues: (1) whether and how they inventory and sell the personal data of their website visitors and/or downloaders of their mobile app; (2) consumers’ rights to their data upon request, and their rights to opt out of having a company sell their data; and (3) whether companies’ agreements with third party vendors or service providers involve the transfer and/or processing of data in a manner that complies with the CCPA.  To the extent that your startup is exempt from compliance with the CCPA (see No. 2), you may be impacted in so far as you have (partnership) agreements in place with BigTech companies.  As BigTech will need to comply, your agreements and privacy practices may be implicated.

Smith Shapourian Mignano PC is available to answer any questions or concerns you may have regarding the CCPA.

This blog does not constitute solicitation or provision of legal advice, and does not establish an attorney-client relationship. This blog should not be used as a substitute for obtaining legal advice from an attorney licensed or authorized to practice in your jurisdiction. You should always consult a suitably qualified attorney regarding any specific legal problem or matter in a timely manner, as statutes of limitations may bar your claim.