OPW - June 22 - We took a look over where CCPA stands. Here's our review, along with a handy PDF overview, as at June-July 2020.
What's the status of CCPA?
On June 1, 2020, the California Attorney General submitted the final regulation package for the California Consumer Privacy Act (CCPA) to the Office of Administrative Law (OAL). CCPA, which went into effect on January 1, 2020, will become fully enforceable once the OAL approves the package.
What is it?
CCPA was designed to protect the privacy of California consumers and provide greater control over the use of personal data. The law mandates several rights, including the right to know, the right to delete, and the right to opt-out of the sale of personal information.
Who does it apply to?
CCPA applies to for-profit businesses which operate in the state of California and collect, share, or sell the personal data of California consumers. Businesses become subject to CCPA if they have annual gross revenues exceeding $25 million, possess the personal information of 50,000 or more consumers, or earn more than half their annual revenue from selling consumers' personal data.
How should you comply?
To comply with CCPA, businesses must take the following actions:
- inform consumers if their data will be sold or shared,
- add a "Do Not Sell My Personal Information" option to their website or application,
- provide a toll-free number to facilitate consumer requests related to personal data,
- affirmatively collect consent to sell data from any consumer under 16,
- affirmatively collect consent from a parent or guardian for any consumer under 13,
- do not discriminate against users who exercise protections under CCPA.
What happens if you don't comply?
The penalties for violating CCPA regulations are severe. Each infraction is subject to a $750 fine, which may be increased if actual damages are higher. A class-action lawsuit can be filed under CCPA if a data breach is due to a business failing to follow reasonable practices and procedures. A qualifying data breach involving the personal information of 100,000 California consumers would result in $75 million in statutory damages. For complete information on the CCPA legislation, please visit the California Legislature website.
