• Contact DPO Centre
  • 0203 797 1289
  • hello@dpocentre.com
DPO CentreDPO CentreDPO CentreDPO Centre
  • * Join Us *
  • Services
    • Outsourced Data Protection Officer
    • Article 27 EU and UK Representation
    • Consultancy
    • Interim Support Services
    • Return-to-Work Compliance Check
    • Training
    • Advice Line
    • The Data Security and Protection Toolkit (DSPT) Audit
    • Caldicott Guardian
    • Services for Schools
  • Sectors
    • Finance &
      Insurance
    • Medical &
      Healthcare
    • Software &
      Technology
    • Retail &
      eCommerce
    • Education
    • Charities &
      not-for profit
  • Case Studies
  • About Us
    • About Us
    • Our Team
    • Benefits of Outsourcing
    • *Join the Team*
    • Events
    • News
  • Blog
  • Resources
    • UK Data Protection Index
    • DSAR White Paper
    • COVID-19 Remote Working Tips
    • GDPR Basics
    • Why you need a Data Protection Officer
    • Why you need GDPR Representation
    • GDPR Policy Toolkit
    • The impact of Brexit on GDPR
    • Christmyths
    • The Full GDPR Text
  • Contact us
  • Home
  • International law
  • CCPA Overview
COOKIE
Cookie Consent – The DPO Centre Guidance
January 20, 2020
software
Data Protection Tools and Software
March 2, 2020

CCPA Overview

March 2, 2020
Categories
  • International law
Tags
CCPA

The California Consumer Privacy ActThe California Consumer Privacy Act (CCPA) is a state statute intended to enhance privacy rights and consumer protection for residents of California.... Overview

The California Consumer Privacy Act (“CCPA”) entered into force on January 2020, bringing with it increased data protection obligations on any business collecting personal dataInformation which relates to an identified or identifiable natural person.... from Californian based consumers. Although similar to the European GDPR the CCPA differs in many ways as it takes a broader view of what constitutes personal data and includes information security. This blog is intended to provide a brief high-level overview.

 

Who does the CCPA apply to?
The legislation (much like the GDPR) applies to organisations regardless of where they are established if they operate for-profitA definition of any organistation which carries out its activities in order to make a profit.... and;

    • Do business in the State of California; and
    • Directly or indirectly collects and control personal information of consumers residing in California.

The organisation must also qualify under one of the following criteria:

    1. It has an annual gross revenueThe sum of all earnings prior to any deductions. exceeding $25m;
    2. It buys, sells or receives the personal information of 50,000 or more consumers residing in California; or
    3. It derives at least 50% of its annual gross revenue from the sale of California based consumers’ personal information.

 

What obligations are imposed on qualifying organisations?

Notification
Much like the GDPR, the CCPA imposes minimum requirements on the type of information that must be provided to consumers prior to (or at) the time of collection. Much of this information will already be in place as part of a GDPR compliant Privacy NoticeA clear, open and honest explanation of how an organisation processes personal data...., but the CCPA provides additional details that must be issued to consumers. This includes a Privacy Policy (Notice), which must be updated at least once every 12 months containing details of;

    • Online and offline privacy practicesMeasures implemented by an organisation with the aim of protecting the privacy of individuals in respect of its "offline" data (i.e. paper-based records, internal systems etc.).... within the organisation;
    • The right to opt-outA positive action to choose not to be part of an activity or to stop being involved in it.... if the business intends to sell the consumer’s personal information to a third party;
    • Any incentives offered to consumers for the collection, sale or retentionIn data protection terms, a defined period of time for which information assets are to be kept.... of their personal information; and
    • Specific categories of data which must be included in the Privacy Policy itself. These may also include supplementary information required under subordinate legislation to the CCPA and are unlikely to be contained already in GDPR compliant Privacy Notices.

 

Enhanced consumer rights
Shadowing the expansion of data subjectAn individual who can be identified or is identifiable from data.... rights under the GDPR, the CCPA requires qualifying organisations to increase the control that consumers have over their personal information, this includes the ability to request deletion of their personal information (subject to certain exceptions) and details of what information the organisation held in the previous 12 months including:

    • The categories of personal information collected;
    • The specific information collected from that consumer;
    • The categories of sources from which this information was collected;
    • The purpose of collection;
    • The categories of third parties; and
    • The categories of personal information sold to third parties (and their business purpose).

 

Methods of consumer requests
Organisations are required to provide a simple method for individual consumers to contact them and request information regarding their personal information.
Businesses are also required to verify consumer identities prior to releasing their information. The methods of verification will be issued by the Californian Attorney General (who regulates the CCPA and its sub-ordinate laws).

 

Regulating the sale of consumer information
Consumers must be notified of any potential sale of their personal information and given the ability to opt-out. Any business selling such data must have a clear “Do Not Sell My Personal InformationInstruction from the data subject under the California Consumer Privacy Act (CCPA) explicitly expressing that their personal data should not to be sold or monetised....” link on the organisation’s website which allows consumers to select an opt-out for such a sale of their data. There are more stringent rules for the sale of personal information of any consumer under 16 (requiring an “opt-inA positive action to express an indication to be part of an activity or to be involved in it....”), which must be given by a parent if the consumer is under 13 years of age.  Importantly, consumers must not be discriminated against for choosing to opt-out or not opt-in to a sale of their personal information.

 

Record Keeping and Service Providers
The CCPA mandates specific periods of retention for consumer requests and there are certain terms that must be included in service provider contracts to prevent the onward sale of consumer data.

 

Penalties
The California Attorney General is able to impose a fine of up to $2,500 for an unintentional violation, and up to $7,500 for an intentional violation. As each individual affected constitutes a violation, this means the maximum CCPA fines could dwarf those of GDPR.

The legislation also allows a course of action for individual consumers to sue organisations for failing to adequately implement sufficient safeguards under the CCPA.

 

Actions
If your business qualifies as being under scope of the CCPA, it is essential that you consider what actions you will need to take to ensure compliance prior to the California Attorney General beginning full enforcement in July 2020. The above measures should be used as guidance only and are not an exhaustive list of all the obligations under the legislation, and these should be combined with the advice of qualified local advisors.

Share

Contact us

The DPO Centre Ltd
Head Office: 50 Liverpool Street, London, EC2M 7PR
The DPO Centre (Europe): Alexandra House, 3 Ballsbridge Park, Dublin, D04 C7H2, Ireland
Registered Office: Suffolk Enterprise Centre, Felaw Street, Ipswich, IP2 8SJ
Telephone: +44 (0) 203 797 1289
Company Number: 10874595 VAT: GB 275694357

More information

  • Contact us
  • Sitemap
  • Privacy Policy
  • Cookie Notice

 

© 2021 DPO Centre. All Rights Reserved.