There is an update for October 2019 at the foot of this article.
Introduction
The California Consumer Privacy Act of 2018 (CCPA) is a privacy law that was passed on June 28, 2018 and will take effect on January 1, 2020.
Who is affected?
What are the headline changes to data protection in California?
What are the main features of the CCPA?
What must be included in a Privacy Policy?
5 Rights of the Data Subject in the CCPA
More Definitions
Fines
It is indicated below where Vuture technology in particular can help clients to be compliant in their handling of contact data.
Who is affected?
All California residents will be affected, but not all businesses will have to comply with the CCPA. Where the CCPA refers to a “business,” it means a legal entity that has the following characteristics:
It is operated for profit,
It does business in California,
-
It decides why and how personal information is processed, and it has one or more of these characteristics:
It has a gross revenue of over $25 million per year, or
It buys, sells, receives or shares personal information from over 50,000 consumers, households or devices per year, or
It makes half or more of its revenue per year from selling personal information.
What are the headline changes to data protection in California?
The CCPA introduces changes that include:
Strict transparency obligations
A very broad new definition of “personal information”
Several new rights for consumers which affected businesses must facilitate, and
A new regime of fines that can be levied on businesses who fail to protect consumers’ personal information.
What are the main features of the CCPA?
The CCPA places new obligations on affected businesses and gives California residents some new rights over their personal information.
Affected businesses must:
Take note of the broad new definition of personal information,
Provide transparent information about their practices to consumers before they collect personal information from them.*(see later section on Privacy Policies) Vuture says: We encourage the use of full text Privacy Policies with a link to these policies from all Vuture emails and web pages.
Facilitate a consumer’s request for the deletion of their personal information. Vuture says: A contact has the right to request that their personal data is removed when there is no compelling reason for its continued processing. You can ask us (via Support) for this to be done. (When that is done you will need to keep some way of knowing that they have been forgotten to prevent them being added again in future.)
Plus: Vuture encourages all our clients to implement a data retention policy so that information is only held for as long as necessary.
Provide a copy of any personal information they hold on consumers on request. Vuture says: the Preference Manager provides an easy, secure place in which contacts can view and manage the information held about them and their mailing preferences. Our pre-filled forms also offer the contact a quick view of their personal data.
Provide a way for consumers to opt out from the sale of their personal information. Vuture says: the Preference Manager makes this quick and easy for all contacts. In addition, we can include an Opt Out on every mailing which will then suppress the contact from receiving further mailings.
Obtain consent from the consumer for the sale of their personal information if the consumer is under the age of 16, or from their parent or guardian in the case of a consumer under the age of 13. Vuture says: we offer all our clients How To guides to assist them in setting up a process for gathering and storing Consent.
Not discriminate against consumers in any way if they have exercised their consumer rights under the CCPA.
Pay a fine if they fail to properly protect consumers’ personal information.
What must be included in a Privacy Policy?
Before a business collects personal information about a consumer, it must tell them what types of personal information it is collecting, and how it will use each type of personal information it collects. One of the things a business must provide in its Privacy Policy is information about consumers’ rights under the CCPA, and how to access those rights.
Businesses must also reveal the types of third parties they share personal information with. Where relevant, a business must also explain the following things in its Privacy Policy:
The commercial reason it collects and sells information
A link to its “Do Not Sell My Personal Information” page
Whether it sells consumers’ personal information, and if so, what types of personal information it sells
Where it gets the personal information it collects.
Five Rights of the Data Subject in the CCPA
The Right to Disclosure
Most of the obligations on businesses under the right to disclosure are discussed in the “Privacy Policy” section. One additional requirement on businesses is to:
Provide a clear and conspicuous link on the business’ Internet homepage, titled ‘Do Not Sell My Personal Information'
The Right to Deletion
The CCPA states that a consumer: “has the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.”
The business also has to contact any service providers with whom they have shared the consumer’s personal information and request that they delete the consumer’s personal information as well.
Note that the business is only obligated to delete personal information it has collected from the consumer this doesn’t explicitly include personal information it has collected from third parties.
Similar to GDPR exemptions, there are several reasons that a business might not have to carry out the deletion request. For example:
To carry out a contractual obligation or complete a contract with the consumer
For security or legal reasons
For debugging purposes
If deletion would infringe its freedom of speech or other rights
If it is legally required to allow access to the information under the California Electronic Communications Privacy Act
For research in the public interest (if the consumer has consented)
For internal purposes which the user might reasonably expect the business to carry out.
Vuture says: We can help in this regard with not only an easy way to delete a contact’s data, but also a method of retaining the fact that they have requested to be deleted – to prevent them from being re-added.
The Right to Access
The CCPA provides consumers with the right to access their personal information. Businesses covered by the CCPA that collect consumers’ information must provide the following on request:
The categories of personal information it collects (e.g. name, phone number, date of birth)
The specific pieces of personal information it has collected about the consumer
The categories of sources of the personal information
The commercial purpose for collecting or selling personal information
The categories of third parties with whom the business shares personal information.
Additionally, where a business sells (or discloses for a commercial purpose) consumers’ personal information, the following additional information can be requested by the consumer:
If the business has not done either of these things, it must disclose this.
The information must cover the preceding 12 month period and must be provided in a “readily usable” format (for example, an HTML file), provided free of charge and within 45 days. An additional 45 day extension to this period is possible when reasonably necessary. The customer’s identity must be verified first. Businesses aren’t required to comply more than twice over a 12 month period to the same consumer.
There is an exception to this obligation – if the consumer only carried out a single transaction with the business, and the business hasn’t sold the personal information it acquired from this transaction. In this case, the business isn’t obliged to retain this information just in case the consumer requests access to it.
Vuture says: Subject Access Requests or SARs are made easier for Vuture clients by ready access to Vuture reports showing the data we hold, plus the Preference Manager which displays to a contact the data held about them.
The Right to Opt Out
Businesses not only have to give consumers the option to forbid the sale of their personal information. they also have to make it easy for them to do this by:
Providing a link to a “Do Not Sell My Personal Information” page on its homepage, and
Not requiring consumers to create an account in order to make this request
A business can invite a consumer to opt back in, but only after 12 months of them opting out.
Whilst this right is actually narrower in scope than the right to object and the right to restrict processing under the GDPR, it’s possible that the right to opt out will have a bigger impact on businesses. This is because of the conspicuous way that businesses must draw their consumers’ attention to this right.
Under the GDPR, a user might read about their “right to object to the means in which personal data is processed” in a business’s Privacy Policy. Under the CCPA, consumers will be invited to tell a business “Do Not Sell My Personal Information” every time they visit its homepage.
That being said, any business that’s complying with the GDPR should already have systems in place for carrying out data restriction and objection requests.
4a. Children’s Right to Opt In
Rather than a “right to opt out,” minors (children) have a “right to opt in.” The Privacy Rights for California Minors in the Digital World Act defines a “minor” as a California resident under the age of 18.
There are some specific rules around selling the personal information of minors:
If a business knows a consumer is a minor aged between 13 and 16, it may not sell their personal information without their consent.
If a business knows a consumer is under 13, it may not sell their information with their parent or guardian’s consent.
If a business “willfully disregards” a consumer’s age, it will be deemed to know their age.
The Right to Non-Discrimination
There’s little point in having consumer rights if a business can “punish” consumers who exercise them. The CCPA states that:
“A business shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights […]”
The CCPA suggests four ways in which a business might discriminate:
By refusing to provide goods or services,
By denying discounts or charging extra for consumers who have exercised their rights,
By providing a poorer level of service to consumers who have exercised their rights, or
By threatening a consumer with any of the above if they choose to exercise their rights.
More Definitions
Consumer means a California resident:
“(1) every individual who is in the State for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the State who is outside the State for a temporary or transitory purpose.”
This effectively means anyone who lives in California, even if they are temporarily outside of California, e.g. on vacation. The definition doesn’t cover visitors to California.
Personal information is defined in the CCPA as:
“information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”
This is a very broad definition, and note that it extends to a “household.” Specific examples are given in the CCPA. These include a person’s:
Name
Postal address
IP address
Email address
Social security number
The CCPA also lists general categories of data that must be considered personal information, such as:
Protected classifications including race, sex, nationality, etc.
Internet data, including browser history and cookies
Geolocation data
This is not an exhaustive list of the examples given in the CCPA.
A service provider is a company that “processes information on behalf of a business” The business decides how and why personal Information is processed, and the service provider merely does as instructed by the business.
Fines
Businesses who infringe the CCPA will be fined up to $7,500 per violation. This might sound like a relatively small amount in comparison to the GDPR’s maximum fine of €20 million or 4 percent of annual global turnover. But this will quickly add up if large-scale or repeated infringements occur.
Twenty percent of the fine will be paid into the newly created Consumer Privacy Fund. This fund is supposed to cover the costs of enforcing the CCPA.
The CCPA doesn’t introduce any specific new obligations on businesses to keep personal information secure or inform consumers of a security data breach. These obligations are covered in existing laws such as that found at California Civil Code § 1798.82. However, the broader definition of personal information means that breach reporting is likely to become more common.
Update for 21 October 2019
On Friday 11 October the Governor of California signed 7 legislative proposals to amend the California Consumer Privacy Act (CCPA). These amendments will change the new privacy law before it goes into effect on January 1st 2020.
The 7 amendments are:
CLARIFYING AMENDMENTS & EXEMPTIONS: Assembly Bill 1355 exempts deidentified or aggregate consumer information from the personal information definition; creates a one-year exemption for certain B2B communications or transactions; and broadens the existing exemption for compliance with the federal Fair Credit Reporting Act (FCRA). Specifically, AB 1355 exempts from most of the act’s provisions personal information about an employee, owner, director, officer or contractor of a business or government agency collected by a business as part of B2B transactions, in the context of due diligence of, or the provision of products or services to, the business or agency. The exemption does not apply to the right to opt out of the sale of a consumer’s data or obligation not to discriminate against a consumer for attempting to exercise other rights.
DATA BROKER REGISTRATION: Assembly Bill 1202 requires data brokers to register with the California Attorney General.
EMPLOYEE EXEMPTION: Assembly Bill 25 changes the CCPA so that the law does not cover collection of personal information from job applicants, employees, business owners, directors, officers, medical staff, or contractors for one year. Businesses are still required to provide employees with notices about what categories of information a business collects about them and their purpose for doing so, but they do not need to offer opt-out, access, and deletion rights.
CONSUMER REQUEST FOR DISCLOSURE METHODS: Assembly Bill 1564 requires businesses to provide two methods for consumers to submit requests for information, including, at a minimum, a toll-free telephone number, but provides that, for a business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information, is only required to provide an email address for submitting CCPA requests.
VEHICLE WARRANTIES & RECALLS: Assembly Bill 1146 exempts vehicle information retained or shared for purposes of a warranty or recall-related vehicle repair.
PUBLICLY AVAILABLE INFORMATION: Assembly Bill 874 streamlines the definition of “publicly available” to mean information that is lawfully made available from federal, state, or local government records. The amendment also clarifies that the definition of “personal information” excludes deidentified or aggregate consumer information.
DATA BREACH NOTIFICATION: In the context of data breaches, Assembly Bill 1130 revises the personal information definition to add specified unique biometric data, tax identification numbers, passport numbers, military identification numbers, and unique identification numbers issued on a government document in addition to those for driver’s licenses and California identification cards to these provisions. The amendment also authorizes inclusion in the data breach notification involving biometric data, instructions on how to notify other entities that used the same type of biometric data as an authenticator to no longer rely on data for authentication purposes.
