California Consumer Privacy Act (CCPA)

What is the California Consumer Privacy Act?

• Data security safeguards. Establishing and maintaining proper security procedures, policies, and practices to protect consumer data from unauthorized access or use;
• Consumer privacy request mechanism. Creating a process for consumers to make privacy requests, including the deletion of consumer data and access to consumer data covering the prior 12-month period;
• Data processing agreements. Requiring businesses to enter into data processing contracts with service providers who process consumer data on behalf of the business and with third parties to whom the business sells, shares, or otherwise discloses consumer data;
• Consumer notices. Providing consumers with an easily accessible point of collection notice disclosing certain information related to consumer data collection, notice of sale or sharing of personal information, and, if applicable, a loyalty program notice; and
• Anti-discrimination. Preventing discrimination against consumers for exercising their privacy rights under the CCPA.

Whether intended or not, violations of the CCPA can bring steep consequences. In addition to penalties enforced by the CPPA and the attorney general, consumers are granted a limited private right of action for personal information security breaches and can therefore take legal action themselves. Businesses should maintain a procedure for handling notifications of consumer lawsuits under the CCPA, as there is just a 30-day cure window to address potential security breach violations.

An experienced attorney can provide further insight into which companies are subject to CCPA compliance regulations, and how these regulations can impact your business activities in the state of California.