Get Ready for The California Consumer Privacy Act

The California Consumer Privacy Act (AB 375) is set to take effect January 1, 2020.
The bill sets significant requirements on for-profit companies that employ CA residents.  In particular, companies are subject to the CCPA if they meet any of the following requirements:
  • They have annual revenue over $25,000,
  • possess personal information on at least 50,000 consumers, or
  • earn more than half their money from selling data.
Even if you don’t fall into this category, you will likely still feel the effects of this legislation:
  • California residents have more control of data they share with companies, if they know their rights
  • Residents employed by a company subject to the CCPA have more control of their data (note that some provisions may be delayed until 2021)
  • In an effort to comply, some companies that are subject to the CCPA may impose new, stringent requirements on vendors they share data with
  • More states will follow the lead of CA and come up with their own — possibly disjointed — legislation
  • Are a minor (their are additional provisions for handling the data of CA residents under 16 years old)
Some of the specifics include:
    • California residents have a right to know and see what data a company collects and stores, and whether the data is sold or even disclosed to third parties
    • California residents may direct a company not to sell their personal data
    • California residents may instruct a company to delete their data (subject to other regulatory requirements that force a company to keep such data for the purpose of conducting business)
    • Companies may not discriminate against a California resident when the resident exercises his/her rights under the CCPA
    • Companies may owe penalties to CA residents if they suffer a data breach

The definition of personal information covered by this regulation includes names, addresses, email addresses, social security numbers, drivers license numbers, passport numbers, biometric data, geolocation data, audio or visual recordings, employment information, educational background, or other identifying information.

 For companies, needing a more detailed overview, I suggest starting with this book: The California Consumer Privacy Act (CCPA): An implementation guide.
If you are a company subject to the CCPA or a California resident who feels their privacy rights are being violated, contact an attorney who specializes in privacy law.