CCPA (Cali­for­nia Consumer Privacy Act)

Following a major consumer data scandal involving Facebook and Cambridge Analytica in 2018 several new privacy reg­u­la­tions were es­tab­lished. The General Data Pro­tec­tion Reg­u­la­tion or GDPR is among the most widely pub­li­cised. It ensures that companies are fined if they violate consumer data rights. Although the GDPR applies to some US companies doing business in the EU, it’s largely a European ini­ti­at­ive. That’s why the Cali­for­nia Consumer Privacy Act or CCPA was enacted in 2018 to ensure that US consumers could demand that companies in pos­ses­sion of their data would delete them if asked to. The new law is effective as of the 1^st of January, 2020. But what is the CCPA? What are its major pro­vi­sions? How does it differ from the GDPR? And what does it mean for UK companies doing business in the US?

The CCPA is a consumer privacy act (AB 375) which enables Cali­for­nia residents to request to see all the personal in­form­a­tion a company serving in the state of Cali­for­nia may hold on them. In addition, companies must disclose which third parties they have shared the data with. If the law is violated, consumers are able to sue a business for breach of reg­u­la­tion.

It was signed into law by Jerry Brown, the Cali­for­nia Governor, in June 2018, and ori­gin­ally born from a ballot ini­ti­at­ive that collected over 600,000 sig­na­tures. The final Act is widely con­sidered to be prefer­able over a ballot ini­ti­at­ive because it can be amended in the future. In contrast, US ballot measures – once initiated – cannot be easily amended.

Defin­i­tions of what one considers to be “private” or “personal” can differ from company to company. Under the CCPA, personal in­form­a­tion is defined as any data that could identify or describe or in­dir­ectly link to a person. Whilst name, email, date of birth and address are clear examples of personal data, the Act goes much further. For example, it includes com­mer­cial in­form­a­tion such as any records of products that a consumer purchased or rented. Other cat­egor­ies of “personal” in­form­a­tion protected under the Act include online activ­it­ies such as a user’s browsing history, audio history, geo­loca­tion data or em­ploy­ment-related in­form­a­tion. However, it does not cover in­form­a­tion that is publicly available. You can view a full list of what con­sti­tutes “personal” in­form­a­tion under the CCPA here.

The Act has several major pro­vi­sions that US and in­ter­na­tion­al busi­nesses must adhere to. Among them, consumers can request to know which personal in­form­a­tion a company holds on them. At the same time, companies must state what kind of in­form­a­tion they collect as part of their privacy policy and what the purpose for col­lect­ing this in­form­a­tion may be. Anyone could also request to know what their in­form­a­tion is being used for and with whom it has been shared.

Consumers now have the right to opt out of busi­nesses selling their in­form­a­tion to others. If a consumer requests that their data be deleted, companies aren’t allowed to refuse their service with some ex­cep­tions. For example, a health­care insurer wouldn’t be able to provide a service without col­lect­ing certain consumer data like date of birth or known health con­di­tions.

The Act also stip­u­lates that busi­nesses must provide a website and a free-to-call phone number for consumers to make a request to have their data deleted. Any requests made to view their personal in­form­a­tion by a consumer must be followed up on within 45 days after it was received. With the January start date of the Act, companies will need to verify records dating back 12 months.

Here’s an overview of some of the CCPA’s major stip­u­la­tions:

• Consumers can ask to view the in­form­a­tion a business has collected on them (including the type of data and format) and shared with any third parties dating back 12 months.
• Consumers can request their in­form­a­tion to be deleted.
• Consumers may opt out of their data being sold.
• Consumers have a right to not be refused service, with some ex­cep­tions.
• Consumers have a right for their request to be answered within 45 days.

The Act applies to all for-profit companies that provide services or products to residents in the US state of Cali­for­nia which:

• Earn over $25 million (around £19 million) in revenue each year, or
• Have collected personal data on more than 50,000 Cali­for­nia residents, or
• Make 50% of their revenues from selling personal in­form­a­tion of Cali­for­nia residents

This means that a business doesn’t ne­ces­sar­ily have to be based in Cali­for­nia or even in the US to have to comply with the CCPA. Indeed, an in­ter­na­tion­al company that falls under the above will also need to adhere to the Act. Im­port­antly then, it doesn’t matter whether a UK business has an office in the US, what matters is whether they sell services or products to Cali­for­nia residents.

In reality, given Cali­for­nia’s large pop­u­la­tion, many large companies are already serving Cali­for­nia residents. Although busi­nesses can install IP trackers to monitor whether they’re serving Cali­for­nia customers, such costly tech­no­lo­gic­al additions may not be suitable for all busi­nesses. It’s, therefore, more likely that busi­nesses will update their privacy policies to comply with the Act for all their customers. As data laws keep changing to address privacy concerns by consumers, it’s expected that most US states will adopt more stringent reg­u­la­tions in the near future. This may have wide-reaching con­sequences for UK busi­nesses.

Small companies which do not collect large amounts of data, non-profit or­gan­isa­tions and sole traders who do not collect data or earn more than the threshold aren’t covered under the Act. There are some other companies which are exempt from the CCPA law, including insurance providers, agents and support or­gan­isa­tions. That’s because the latter are already covered under the Cali­for­nia Insurance In­form­a­tion and Privacy Pro­tec­tion Act. In the UK, insurance companies need to be GDPR-compliant. UK insurers who deal with Cali­for­nia residents should consult the CCPA or a lawyer to confirm which reg­u­la­tions apply to them in the US.

The CCPA is effective as of the 1^st of January, 2020. This means all relevant busi­nesses will now need to comply with the reg­u­la­tions. However, because consumers can request data dating back 12 months, most busi­nesses should have had data col­lec­tion and man­age­ment systems in place since the start of 2019.

If a consumer complains that the Act has been violated, companies have 30 days to comply with the law. Where a business does not act swiftly or fails to comply, they may face fines up to $7,500 (around £5,760) per case. For a company that deals with thousands of consumer records in­ten­tion­al or un­in­ten­tion­al non-com­pli­ance could become costly quickly.

What’s more, the bill, for the first time, grants consumers the right to sue a company – either in­di­vidu­ally or as a class. At the moment, it’s not known what statutory damages in the event of a class-action lawsuit could look like or what the upper threshold may be. It’s, therefore, advised that companies take the Act seriously and ensure they comply. However, companies can avoid fines and lawsuits as long as they respond to customers within the time frame of 30 days and make any requested amend­ments swiftly.

For un­au­thor­ised access and data breaches, for example, theft or neg­li­gence, the Act states that consumers can receive damages between $100 (£77) to $750 (£575) per customer and incident. All fines apply to US and in­ter­na­tion­al companies alike.

Because most UK busi­nesses will have already updated their privacy policies to comply with the GDPR, they’re already on track to comply with much of the CCPA as some of the pro­vi­sions are similar between the two. But how similar are the CCPA and the GDPR?

The CCPA is often dubbed the “American GDPR”. That’s because, in essence, many of its pro­vi­sions are similar to the European coun­ter­part. However, the CCPA is seen as a slightly more expansive and arguably stricter law than the GDPR. One of the main dif­fer­ences between the CCPA and the GDPR is the opting-out ar­range­ment. Whilst the GDPR requires companies to allow consumers to opt out of data pro­cessing, the CCPA only enables opting out of the sale of personal in­form­a­tion. That means companies can still collect private data, but can’t sell it without consent. The key dif­fer­ences and sim­il­ar­it­ies between the two are shown in the table below.

Sources: PWC and In­form­a­tion Com­mis­sion­er’s Office

The CCPA has far-reaching con­sequences for many busi­nesses in the US and abroad. “Our personal data is what powers today’s data-driven economy and the wealth it generates. It’s time we had control over the use of our personal data. That includes keeping it private,” said Xavier Becerra, the Cali­for­nia Attorney General. As a con­sequence, companies may incur con­sid­er­able costs to comply with the Act. They should also prepare for a large number of consumer requests to come in and the even­tu­al­ity of fines and lit­ig­a­tion. Companies that already comply with the GDPR will need to carefully examine whether they should make ad­di­tion­al updates to their privacy policies. Over the next few years, there’ll likely be several updates to the CCPA and busi­nesses will need to make sure they keep up with changing reg­u­la­tions.

UK companies should make no as­sump­tions. Just because they comply with the GDPR doesn’t mean they are auto­mat­ic­ally covered under the CCPA. Although the laws are broadly similar, there are also many dif­fer­ences. For example, the CCPA includes much more extensive in­form­a­tion on what con­sti­tutes personal in­form­a­tion and UK companies need to ensure they track these. In­ter­na­tion­al companies are therefore advised to assess whether any com­pli­ance gaps exist and address them swiftly to avoid fines.

The Cali­for­nia Consumer Privacy Act is seen as the beginning of a wave of privacy reg­u­la­tions sweeping the US. Experts predict that 2020 will be a key year for major updates to consumer personal data pro­tec­tion laws, es­pe­cially in states like New York and Mas­sachu­setts, where the New York Privacy Act and the Act Relative to Consumer Data Privacy are already pending, re­spect­ively. UK business owners are advised to put measures into place that allow them to adapt quickly to new or changing personal data re­quire­ments.

Please note the legal dis­claim­er relating to this article.