California’s New Data Privacy Law -- What Does Your Business Need to Know?
In less than a year, the most comprehensive state-level consumer privacy legislation in the country will go into effect in California. The California Consumer Privacy Act (“CCPA”) continues the trend toward comprehensive data protection laws and gives consumers more control over their data.
What Type of Information Does the CCPA Protect?The CCPA protects “Personal Information,” which it defines as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with to a particular consumer or household.” This includes obvious categories of information such as a consumer’s name, email address, and social security number. However, it also includes information about a consumer’s personal property, biometric information, internet and/or network activity, professional and educational background, personal pictures and videos, and their geolocation data. If the information can be used to identify an individual or household, it is likely Personal Information and therefore the CCPA applies to its collection, use, and disclosure.
Does the CCPA Apply to My Company?The CCPA applies to companies that collect and control a Californian’s Personal Information and/or do business in California AND 1) have an annual gross revenue of $25,000,000.00 or greater; 2) collect, buy, share, or otherwise receive or disclose Personal Information from 50,000 or more consumers, households or devices; OR 3) derive at least 50% of their revenue from selling Personal Information. Thus, the CCPA does not only apply to large businesses. The $25,000,000.00 revenue threshold represents gross revenue before any deductions and many companies may end up collecting Personal Information from more than 50,000 consumers through normal adverting and operations. It is important to keep these requirements in mind as your company expands.
The CCPA Applies to My Company, What Do I Need to Do?The CCPA will require your company to engage more with its customers regarding the Personal Information it collects from them and the categories of third parties to whom it discloses such Personal Information and for what purpose(s). Similarly, upon request, consumers will have the right to view their Personal Information, know the sources from where their Personal Information was collected, and know to whom your company discloses the same.
This is by no means an exhaustive list of the CCPA’s provisions and although companies have several months before they need to comply, it is important to familiarize yourself with the requirements now to avoid difficulties with timely implementation. If you have questions about how the CCPA and other privacy laws may affect your business, contact an attorney who specializes in privacy today.