California Privacy Law Now in Effect
A new California state privacy law took effect on Wednesday, January 1, 2020. The California Consumer Privacy Act (CCPA) requires companies to disclose what data they collect from consumers and how they plan to use them. The CCPA also allows consumers to request that their data not be sold and that the companies delete their data. The law applies to companies that have revenue of $25 million or more and that make more than half of their money selling data, and to companies that collect data on 50,000 or more individuals. California's attorney general says the law will start being enforced until July 1, 2020.
Meaningful enforcement action by July 1 is very unlikely, as there are many areas where the wording of the Act is broad and open to interpretation and the industry legal actions to fight/delay will be fast and furious. Advice to corporate management: whether CCPA gets delayed or not, consumer demand and legislative trends are definitely on the side in the companies needed to give customers more visibility and more control over the use of their personally identifiable information. Companies can save money in the long run by skipping the "OK, let's just wallpaper our website with disclaimers" stage by starting with "let's make our customers happy and safe, and then be able to easily demonstrate GDPR/CCPA et al compliance."
One of the challenges in implementing CCPA is that legal guidance is not finalized. For example, while it appears to exclude non-profit entities, a small institution doing online business may have data on over 50,000 devices, which may put them back in-scope for CCPA. Work with your legal department to establish and record your applicability decision. The good news is the implementation can leverage measures taken for GDPR; even so, CCPA specific guidance is still maturing.
One has been thankful to the California Legislature in the past for going where angels fear to tread. Their reach has been long, their aim true, and their impact salutary. One hopes that this effort will prove to be as effective. However, as with much law, the devil is in the detail and the enforcement.