We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
At the end of June, the California legislature passed its
Bill 375, the California Consumer Privacy Act of
2018. The Act contains a number of concepts
that would be familiar to those who are working to bring their
companies and organizations into compliance with GDPR.
The new law defines a category of "Personal
Information" that radically departs from a
traditional definition of Personal Data commonly found in various
State Data Privacy Laws, which usually ties an individual name to
other identifiers like social security number, account number, or
other factors. Instead, the California Act
defines "Personal Information" as information that
identifies, relates to, describes, is capable of being associated
with, or could reasonably be linked, directly or indirectly, with a
particular consumer or household. It does not,
mercifully, include publicly available information, but it still
comes closer to a GDPR-like definition of
"personal data" than any other US law.
The Act provides California residents some rights that
also appear familiar. For example:
Consumers can request a copy of all the Personal
Information a business has collected;
Consumers have the right to request that the
business delete their Personal Information (subject to some
exceptions), and a right to direct a company to not share
their Personal Information with third parties; and
Consumers can request that a business disclose the
categories of information it has collected, the sources of
information, the purpose for the collection and/or its sale of the
information, and the third parties with whom the information is
shared.
These certainly sound like concepts that could be
referenced as The Right to Access; The Right to Be Forgotten; and
Data Portability.
Business requirements include:
Meaningful notifications to consumers at the point of contact
where Personal Information is collected;
Updated online privacy notices to include the types of
Personal Information collected, the purpose of collection, and
rights information;
Implementation of Data Security measures to protect
Personal Information;
Providing training to employees handling Personal Information
or involved in consumer inquiries;
The inclusion of provisions in contracts with third
parties with whom Personal Information is shared to include data
privacy protections and restrictions on disclosure; and
The inclusion of a "do not sell my personal
information" option on public facing interfaces
and websites that collect personal
information. Companies must take measures to not
discriminate against users who opt out, but at the same time they
can offer price incentives to those who chose to opt in.
The Act takes effect on January 1, 2020. It has the same
approximate 2 year "runway" period that GDPR provided in
2016 (leading up to May 25, 2018) for companies to gear up their
compliance. This law has potentially widespread
impact, but some of the mechanisms of its application remain
unclear, due in some degree to some of its broadly worded
language. In this way, it is also similar to the GDPR.
The challenge with implementation for large companies is the
same as every other State level data privacy
law – it is often virtually impossible
to reliably identify who the "California"
consumers are. Thereby making it
by practical necessity a global requirement for
all publicly facing systems and applications for all
users.
We recommend that most companies prioritize and stage their
compliance today, focusing on GDPR in the short term, but a
California (or potentially necessary practical nationwide)
compliance strategy should be included in late 2018
and 2019 IT and Privacy compliance plans.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
For your ease of reference, we reproduce here a formatted, hyperlinked copy of the California Consumer Privacy Act of 2018 (CCPA), current as of October 15, 2018.
On the heels of the California Consumer Privacy Act ("CCPA"), the state of New York has kicked off the New Year with proposed legislation in the same vein as the CCPA.
CF On Cyber: The GDPR's New Territorial Scope Guidelines
