California Consumer Privacy Act: The basics

The rising number of data breaches has driven countries and states to establish their own privacy policies and regulations to secure the data of residents. In 2018, the European Union (EU) introduced the General Data Protection Regulation (GDPR), which affects how companies use customers' personal data, and impacts have been felt all over the world. In early 2020, California will roll out the California Consumer Privacy Act (CCPA). In the first blog of this two-part series, we will dissect what the CCPA is, what kind of information will be regulated, and which businesses must comply.

What is the CCPA?

The CCPA is the first state-level privacy law in the United States that protects consumer rights by enabling residents to control the collection and use of personal information by businesses. 

When does it go into effect?

The CCPA goes into effect on January 1, 2020. 

What consumer data is quantified as personal information?

Some examples are:

• Identifiers such as a real name, alias, postal address, unique personal identifier, email address, account name, Social Security number, driver’s license number, passport number, and others. 
• Records of personal property, and products or services purchased, obtained, or considered.
• Biometric information like fingerprint or facial recognition data.
• Internet or other electronic network activity information, including browsing history, search history, etc.

Which businesses are required to comply?

The CCPA applies to any for-profit organization that meets any of the three following requirements:

• Has annual gross revenues in excess of $25 million.
• Alone or in combination annually buys, receives for commercial purposes, sells, or shares for commercial purposes the personal information of 50,000 or more California consumers.
• Derives 50 percent or more of its annual revenues from selling consumers’ personal information.

In the next blog, we'll discuss what the CCPA means for consumers, what businesses can do to prepare for the CCPA, and the penalties for non-compliance.