The California Consumer Privacy ActThe California Consumer Privacy Act (CCPA) is a state statute intended to enhance privacy rights and consumer protection for residents of California. The California Privacy Rights Act (CPRA) amends and expands the CCPA by introducing new privacy rights for consumers. of 2018 (CCPA) came into effect on 1st January 2020. Whilst there were a series of revisions, a final set of regulations was published on the 1st June 2020 with the intention that enforcement activity would begin from the 1st July 2020. Despite calls from several key marketing groups, the Attorney General’s Office remain committed to enforcing the law starting 1st July 2020, whilst emphasising the importance of data security during the pandemic.
The CCPA grants California consumers robust data privacy rights and control over the handling of their personal dataInformation which relates to an identified or identifiable natural person., including the rights to delete and to opt-out of the sale of personal information that an organisation has collected.
An organisation is subject to the CCPA regardless of where they are established, so long as they operate for-profit, do business in the State of California, and directly or indirectly collect and control personal information of consumers residing in California. Additionally, the organisation must have an annual gross revenueThe sum of all earnings prior to any deductions. exceeding $25m, it buys, sells or receives the personal information of 50,000 or more consumers residing in California, or at least 50% of its annual gross revenue must come from the sale of California based consumers’ personal information.
The Californian Attorney General is able to impose a fine of up to US$2,500 for an unintentional violation, and up to US$7,500 for an intentional violation. As each individual affected constitutes a violation, this means the maximum CCPA fines could become astronomical for some organisations, dwarfing even those of the GDPR.
In addition, The California Privacy Rights Act (CPRA), referred to by some as “CCPA 2.0”, has qualified for the November 2020 ballot. This initiative that is intended to “strengthen” the existing CCPA could result in far-reaching changes and additional requirements on businesses processing personal data on California residents.