California Passes Sweeping Data Privacy Law

California has passed the California Consumer Privacy Act of 2018 (CCPA), which rank among the most stringent privacy laws in the United States. The new law goes into effect on January 1, 2020, and will provide California residents with more control over their personal information and provide significant penalties to covered companies that fail to comply.

The CCPA broadly defines “personal information" to include any information that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

The CCPA is limited to companies that conduct business in California; collect, or have collected on their behalf, the personal information of California residents; and produce annual gross revenues in excess of $25,000,000; buy, receive for their own commercial purposes, sell, or share for commercial purposes the personal information of 50,000 or more consumers, households, or devices; and/or; obtain 50% or more of their annual revenue from selling, releasing, renting, or otherwise making available consumer personal information to a third party for monetary or other valuable consideration. 

The CCPA will impose significant changes in the handling of consumer data. The CCPA gives consumers the right to request that a company to disclose what personal information the company has collected and/or sold; instruct a company to refrain from selling personal information; request that a company delete personal information, and to file a regulatory complaint or bring a private action against a company that fails to secure personal information or otherwise violates the provisions of the CCPA. The CCPA also expands the required privacy disclosures that companies are required to give when collecting or using consumers’ personal information.

The CCPA proves for both consumers and California regulators to bring suit for violations and includes penalties of up to $7,500 for each violation. In addition, the CCPA contains a provision that allows consumers who have suffered a data breach to bring suit against companies for failing to protect their information.

Tip: Companies should work to understand how any personal information is collected, used, and shared. This will enable companies to assess whether the CCPA will apply to them and to update any business practices to comply with the CCPA.

For more information on the California Consumer Privacy Act of 2018, view our briefing.