Editorial · October 18, 2019
CCPA Compliance: Does It Apply to Your Business?
CCPA compliance starts with one question: does the law cover your business at all? The California Consumer Privacy Act takes effect on January 1, the start of next year. Many owners outside California assume it does not touch them. That can be a costly guess.
What the law is
California passed the CCPA in 2018. It gives people who live in California new rights over the personal information that businesses collect about them. A business that is covered must follow those rights. The law is part of the state's Civil Code, starting at section 1798.100.
Where you are based does not decide the question. What matters is whether you do business in California and whether you pass one of three tests.
Sources: California Civil Code sections 1798.100 and 1798.198, California Legislative Information.
The three tests
The law covers a for-profit business that does business in California, collects personal information, and decides how that information is used. It must also meet at least one of these three thresholds.
- Revenue. The business has annual gross revenue above $25 million.
- Data volume. The business buys, receives, sells, or shares for commercial purposes the personal information of 50,000 or more consumers, households, or devices in a year.
- Data sales. The business earns 50 percent or more of its yearly revenue from selling consumers' personal information.
Meeting only one test is enough. A small firm with modest sales can still be covered if it handles enough records. The law also reaches a company that controls, or is controlled by, a covered business and shares its branding.
Source: California Civil Code section 1798.140, definition of "business."
How the data test can catch small firms
The 50,000 figure counts consumers, households, and devices. It is not limited to customers who bought something. A website that gets traffic from California can add up fast if it records visitors' devices or addresses. An online shop, an app, or a local site with a busy mailing list may be closer to the line than its owner thinks.
A sensible first step is to look at what you collect. Check your web analytics, your customer list, your ad tools and your email service. Then count the California records, even roughly. If the number is far below the limit, write that down with the date. If it is close, plan as if the law applies.
Source: California Civil Code section 1798.140.
What a covered business must do
The law lists several consumer rights. A person can ask a business to tell them what categories and specific pieces of personal information it has collected. A person can ask the business to delete the information it collected from them. A person can tell a business that sells personal information not to sell theirs. This is called the right to opt out.
A business must also tell people, at or before the point of collection, what kinds of information it collects and why. If it sells personal information, it must say so and explain the opt-out right. It cannot sell the information of a consumer it knows is under 16 unless the right permission has been given.
Sources: California Civil Code sections 1798.100, 1798.105 and 1798.120.
Penalties and timing
The Attorney General can bring civil actions under the law. A business that does not fix an alleged violation within 30 days of notice can face a civil penalty of up to $2,500 for each violation, or up to $7,500 for each intentional violation.
The statute says the Attorney General cannot bring an enforcement action until six months after final rules are published, or July 1 of next year, whichever comes first. The Attorney General's office has now put out proposed rules. It will take written comments until December 6, 2019, and it has scheduled public hearings in Sacramento, Los Angeles, San Francisco and Fresno from December 2 to December 5. The rules can still change before they are final.
There is one more risk. If a data breach exposes certain unencrypted personal information because a business failed to keep reasonable security, the affected people can sue. They can seek $100 to $750 per person per incident, or their actual damages if those are higher.
Sources: California Civil Code sections 1798.150, 1798.155 and 1798.185; California Attorney General, CCPA rulemaking page.
A short plan before January 1
- Work out whether you do business in California.
- Check your revenue, your record counts and any data sales against the three tests.
- Map what personal information you collect, where it lives, and who else gets it.
- Update your privacy notice so it says what you collect and why.
- Set up a simple way to take requests to see, delete or stop the sale of data.
If you are close to a threshold, ask a lawyer who knows privacy law. This article is general information, not legal advice.
Sources
- California Civil Code, Title 1.81.5, California Consumer Privacy Act of 2018, sections 1798.100, 1798.105, 1798.120, 1798.140, 1798.150, 1798.155, 1798.185 and 1798.198 (leginfo.legislature.ca.gov).
- California Department of Justice, Office of the Attorney General, California Consumer Privacy Act page (oag.ca.gov/privacy/ccpa).