What is CCPA?
CCPS: The California Consumer Privacy Act (CCPA) was the first modern, comprehensive privacy law passed in the United States. It went into effect on July 1, 2020, establishing a range of data privacy rights for consumers and data handling responsibilities for businesses.
What is the California Consumer Privacy Act (CCPA)?
The California Consumer Privacy Act ( CCPA ) is a data privacy law enacted in 2018 to protect the personally identifiable information (PII) of California residents. The law went into effect in January 2020. The CCPA’s legislative objective was to combat the rise in data breaches in the technology, media, entertainment, and telecommunications industries.
The CCPA ensures that California residents have control over how companies handle their PII. It also guarantees that companies respect California residents’ requests for access to and deletion of their PII, as well as their ability to opt out of sharing and selling their personal information.
What is CCPA Compliance?
Modeled after the European Union’s General Data Protection Regulation ( GDPR ), the CCPA requires businesses that collect PII from California residents to provide information about how the data is collected. It also has similarities to Canada’s Personal Information Protection and Electronic Documents Act ( PIPEDA ). To ensure compliance, a business may need to adjust its privacy policy to include:
- The information that a company collects and processes
- The reason why the information is collected and processed
- Methods used to collect and process personal information
- What residents need to do to request access to, change, move, or delete their personal data
- The method that will be used to verify the identity of the person submitting the request
- The sale of users’ PII and how they can opt out of selling their data
What is the Geographic Scope of the CCPA?
The CCPA is a state-level data privacy law, but it applies to companies worldwide as long as they handle personally identifiable information (PII) belonging to California residents. The law is considered one of the strictest privacy laws in the United States.
Organizations That Must Comply with the CCPA
The CCPA applies to all for-profit businesses that collect and control PII belonging to California residents. It also applies to for-profit businesses in California that meet any of the following criteria:
- Gross annual income exceeding US$25 million
- 50% or more of annual revenue is derived from the sale of PII belonging to California residents
- Purchase, receive, or sell the PII of 50,000 or more California residents, households, or devices annually
Organizations Not Subject to the CCPA
The CCPA does not apply to non-profit organizations, smaller businesses that do not meet the income thresholds, and those that do not handle large amounts of PII from California residents.
Other situations where the CCPA does not apply include:
When PII Is Not Involved
The CCPA’s primary focus is PII. Publicly available information—that is, information legally available from federal, state, and local government records—is not subject to the CCPA.
When Other Laws and Regulations Apply
Other data protection regulations already govern some industries. Such laws include the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act ( GLBA ), and the Fair Credit Reporting Act (FCRA). The CCPA exempts data that is already covered by these laws.
Key Provisions of the CCPA
Although the CCPA is often compared to the GDPR, it has a much broader definition of regulatory compliance . The CCPA defines protected PII as data that “identifies, relates to, describes, can be associated with, or could reasonably be linked to a particular individual.”
The CCPA gives California residents the right to request that a company disclose any of the following:
- All data collected about the consumer
- Categories of sources from which information is collected
- The business purpose for collecting that information
- Any third party with whom the information is shared
For businesses, the CCPA defines business purpose as the use of personal information for business operations, provided that such use is reasonably necessary and proportionate to achieve the purpose for which the information was collected or processed. According to the CCPA, business purpose includes:
- Audit related to a current interaction with a consumer and subsequent transactions with the consumer
- Monitoring and detection of security incidents, protection against illegal activities, and prosecution of those responsible for such activities
- Short-term use of personal information is permitted provided that the information is not disclosed to a third party and is not used to create a profile about a consumer or otherwise alter an individual consumer’s experience outside of the current interaction.
- Conducting internal research on a business for technological development
- Provision of services on behalf of the business, such as account maintenance, customer service, order and transaction processing, customer data verification, payment processing, provision of advertising or marketing, and analytical services
- Provision of services to verify or maintain the quality or safety of a service or device for the business
Personal Information Under CCPA
The CCPA ensures the privacy and consumer protection rights of California residents regarding their PII:
- A person’s real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, Social Security number, driver’s license number, or passport number
- Commercial information such as personal property records, purchases, purchase or consumption histories, or trends
- Biometric data
- Internet activity information such as browsing history, search history, and information about a consumer’s interaction with a website, application, or advertisement
- Geolocation data
- Audio, electronic, visual, thermal, olfactory or similar information
- Professional or employment-related information
- Educational information, provided that the information is not publicly available
- Inferences drawn to create a profile about a consumer to reflect the consumer’s identity, preferences, characteristics, trends, behavior, attitudes, and skills
Penalties and Fines for Noncompliance with the CCPA
Failure to comply with the CCPA carries financial penalties and fines. Under the CCPA, the California Attorney General can impose a maximum fine of $7,500 per violation for willfully ignoring CCPA mandates, which is considered an intentional violation. Failure to encrypt user data accessed during a violation, which could be considered an unintentional violation, carries a fine of $2,500 per violation.
The CCPA also grants consumers a private right of action in the event of a data breach due to noncompliance. Consumers can sue a company for statutory damages for such a breach. Before proceeding, a consumer must notify a company of a breach and give them 30 days to address it. If the company fails to address the breach within that period, they become liable for statutory damages of up to $750 per affected consumer.
Steps to Comply with the CCPA
There are several steps that organizations must follow to meet and remain compliant with the CCPA:
1. Establish the Commercial Obligation with the CCPA
The CCPA protects any natural person who is a resident of California. The CCPA mandates that California residents have the right to know what personal information (PII) companies collect about them and how that data is used. A company must allow customers to opt out of the use of that information and ensure that they can obtain a copy of the information the company holds upon request.
2. Map All Retained and Collected Consumer Data
Once a company determines that it is required to comply with the CCPA, the next step is to map all PII under the company’s control.
3. Evaluate all third parties with whom consumer data is sent and/or received
The next step is to do the same with all third parties with whom a company shares PII. As part of an organization’s third-party risk management ( TPRM ), they need to verify that each of these third parties complies with the CCPA. This includes reviewing and updating their privacy policies.
4. Facilitate Consumers’ Exercise of Their Rights Under the CCPA
The next step is to create processes and procedures that consumers can use to exercise their rights as provided in the CCPA.
5. Identify and Implement Any Necessary Operational Changes
Some operational changes to the business may be necessary to accommodate the CCPA. Such changes include how consumer information is collected and handled, how consumer requests will be handled, and how ongoing compliance occurs.
6. Train Employees
The final step is to train employees on how compliance affects your business and how this impacts the handling of consumer data. Teams should be trained on how the CCPA defines a consumer, what it defines as personal information, and how to respond to consumer requests.
Comparing the CCPA with the GDPR
The CCPA and GDPR are laws that regulate how organizations within their respective jurisdictions handle PII. Both laws give individuals greater control over how companies manage their personal information.
The CCPA applies to businesses engaged in for-profit activities that handle, collect, or process personal information for California residents. The GDPR, on the other hand, gives residents of the European Union (EU) control over how businesses collect and use their personal information. The GDPR is uniformly binding in all 27 EU member states. Below is a quick overview comparing the CCPA and the GDPR (adapted from Baker Law):
What is CPRA?
In 2020, the California Consumer Privacy Act was enacted. The California Privacy Rights Act (CPRA) is an amendment to the CCPA that went into effect in January 2023, with enforcement beginning in July 2023. The CPRA amends the CCPA to include more privacy rights for California residents. While the law largely provides the same protections as the CCPA, it updates some of its provisions and introduces several new ones.
The CPRA establishes the California Privacy Protection Agency as responsible for implementing and enforcing this law. It also retains the attorney general as the civil enforcement authority.
Sensitive Content Communications and the CCPA
Private sector companies must track, monitor, and secure digital communications of Personally Identifiable Information (PII) belonging to California residents to comply with the California Consumer Protection Act (CCPA). Historically, companies have relied on numerous tools for communicating sensitive content, using siloed approaches for different communication channels (email, file sharing , file transfer , managed file transfer , web forms, and application programming interfaces [APIs]). This creates a metadata fork that makes it difficult for organizations to establish centralized and automated PII governance and maintain an integrated risk management approach.
