What Is the California Consumer Privacy Act (CCPA)?
The CCPA (California Consumer Privacy Act) is a data privacy law enacted in 2018 to protect California residents’ personally identifiable information (PII). The law came into force in January 2020. The legislative objective for the CCPA was to combat rising incidents of data breaches in the technology, media, entertainment, and telecommunication industries.
The CCPA ensures that California residents have control over how businesses handle their PII. It also ensures that businesses honor requests from California residents on access and deletion to their PII as well as have the ability to opt out of the sharing and selling of their personal information.
What Is CCPA Compliance?
- The information a business collects and processes
- The reason for which the information is collected and processed
- Methods used to collect and process personal information
- What residents need to do to request access, change, move, or delete their personal data
- The method to be used to verify the identity of the person who submits such a request
- The sale of users’ PII and how they can opt out of selling their data
What Is the Geographical Scope of the CCPA?
The CCPA is a state-wide data privacy law but applies to businesses worldwide, provided they handle PII belonging to California residents. The law is considered one of the strictest privacy laws in the United States.
Organizations That Must Comply With the CCPA
The CCPA applies to all for-profit businesses collecting and controlling PII belonging to California residents. It also applies to for-profit businesses in California that meet any of the following criteria:
- Gross annual revenue of over US$25 million
- 50% or more of annual revenue comes from selling PII belonging to California residents
- Buys, receives, or sells the PII of 50,000 or more California residents, households, or devices annually
Organizations Not Subject to the CCPA
The CCPA doesn’t apply to nonprofits, smaller companies that don’t meet the revenue thresholds, and those that don’t deal in large amounts of PII from California residents.
Other situations where the CCPA doesn’t apply include:
When No PII Is Involved
The main focus of the CCPA is on PII. Publicly available information—namely, information lawfully made available from federal, state, and local government records—is not subject to the CCPA.
When Other Laws and Regulations Apply
Other regulations regarding data protection already govern some industries. Such laws include the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), and the Fair Credit Reporting Act (FCRA). The CCPA exempts data that is already covered under these laws.
Key Provisions of the CCPA
Much as the CCPA is compared to the GDPR, it has a much broader definition of regulatory compliance. The CCPA defines PII protected data as that which “identifies, relates to, describes, can be associated with, or could reasonably be linked to a particular person.”
The CCPA gives California residents the right to request a business to disclose any of the following:
- All data collected about the consumer
- Categories of sources from which the information is collected
- The business purpose for collecting that information
- Any third party with which the information is shared
For businesses, the CCPA defines business purpose as the use of personal information for business operations, provided that its use is reasonably necessary and proportionate to achieve the purpose for which the information was collected or processed. According to the CCPA, business purpose includes:
- Auditing relating to a current interaction with a consumer and subsequent transactions with the consumer
- Monitoring and detecting security incidents, protecting against illegal activities, and prosecuting those responsible for such activities
- Short-term use of personal information provided the information is not disclosed to a third party and is not used to create a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction
- Conducting internal research on a business for technological development
- Providing services on behalf of the business, such as maintaining accounts, customer service, processing orders and transactions, verifying customer data, processing payments, providing advertising or marketing, and analytic services
- Providing services to verify or maintain the quality or safety of a service or device for the business
Personal Information Under the CCPA
The CCPA ensures privacy rights and consumer protection of California residents regarding their PII:
- A person’s real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, Social Security number, driver’s license number, or passport number
- Commercial information such as records of personal property, purchases, purchasing or consuming histories, or tendencies
- Biometric data
- Internet activity information such as browsing history, search history, and information regarding a consumer’s interaction with a website, application, or advertisement
- Geolocation data
- Audio, electronic, visual, thermal, olfactory, or similar information
- Professional or employment-related information
- Education information provided the information is not publicly available
- Inferences drawn to create a profile about a consumer to reflect the consumer’s identity, preferences, characteristics, trends, behavior, attitudes, and abilities
Penalties and Fines for Noncompliance With the CCPA
Noncompliance with the CCPA carries financial penalties and fines. According to the CCPA, the Attorney General of California can exact a maximum fine of $7,500 per violation for purposefully ignoring the mandates of the CCPA, which is deemed as intentional noncompliance. Failing to encrypt user data that was accessed during a breach, which could be deemed as unintentional noncompliance, carries a fine of $2,500 per violation.
The CCPA also gives consumers a private right of action in the event of a data breach due to noncompliance. Consumers may sue a business for statutory damages in such a breach. Before proceeding, a consumer must notify a business of a violation and give them 30 days to address the violation. In the event the business fails to address the violation within the period, they become subject to statutory damages of up to $750 per affected consumer.
Steps to Become CCPA Compliant
There are several steps that organizations must follow to become and remain CCPA compliant:
1. Establish Business Obligation to the CCPA
The CCPA protects any natural human being who is a California resident. The CCPA mandates that California residents have a right to know what PII businesses collect on them and how they use that data. A business must enable the customer to opt out of the use of that information and ensure that they can obtain a copy of the information being held by the business upon request.
2. Map All Consumer Data Held and Collected
Once a business determines that it is obligated to comply with the CCPA, the next step is to map all PII under the control of the business.
3. Evaluate All Third Parties With Which Consumer Data Is Sent and/or Received
4. Make It Easy for Consumers to Exercise Their Rights According to the CCPA
The next step is to create processes and procedures that consumers can use to exercise their rights as provided for in the CCPA.
5. Identify and Implement Any Needed Operational Changes
Some operational business changes may be needed to accommodate the CCPA. Such changes include how consumer information is collected and handled, how consumer requests will be handled, and how continuous compliance occurs.
6. Train Employees
The final step is to train employees on how compliance affects your business and how this impacts the handling of consumer data. Teams must be trained on how the CCPA defines a consumer, what it defines as personal information, and how to respond to requests from consumers.
Comparing the CCPA to the GDPR
The CCPA and the GDPR are laws that regulate how organizations within their respective jurisdictions handle PII. Both laws give individuals greater power over how businesses manage their personal information.
The CCPA applies to businesses engaging in for-profit activities and handling, collecting, or processing personal information for California residents. The GDPR, on the other hand, gives European Union (EU) residents control over how businesses collect and use their personal information. The GDPR is uniformly binding in all 27 EU member states. Following is a quick comparison overview of the CCPA and the GDPR (adapted from Baker Law document):
|Who Is Protected||Consumers who are California residents that are:
· In California for other than a temporary or transitory purpose
· Domiciled in California but are currently outside the State for a temporary or transitory purpose
· Consumers of household goods and services
· B2B transactions
|Data subjects defined as identified or identifiable persons to which personal data relates||Different but similarly broad effect
Focus on information related to identifiable natural person but definitions differ
Potential extraterritorial effects for businesses located outside of the jurisdiction
|What Information Is Protected||Personal data that is to be sold for monetary value||Any personal data||Similar|
|Anonymous, Deidentified, Pseudonymous, or Aggregated Data||Deidentification can be used for compliance.
Aggregated data also cannot “reasonably” be linked to an individual or small group.
|GDPR’s concept of anonymization requires that an individual’s identifiable information be irreversibly prevented from being used.
GDPR requires pseudonymization.
|Largely similar but GDPR requires pseudonymization|
|Privacy Notice/Information Right||CCPA gives the consumers the right to know what information is being held and can get a copy of that information||GDPR allows individuals to know how long their information will be held||Similar|
|Security||CCPA does not directly impose data security requirements||Provides the requirement for appropriate technical and organizational measures to secure personal information and reduce security risk||GDPR provides for security of personal information while CCPA doesn’t|
|Opt-out Right for Personal Information Sale||CCPA provides the right to opt out for personal information sales||GDPR allows data subjects to withdraw consent for processing activities and not to allow processing of their data for marketing purposes||CCPA provides the right to opt out for personal information sales while CCPA doesn’t explicitly allow it|
|Children||CCPA addresses the sale of children’s information—not all processing—and requires that businesses first obtain opt-in consent. Parents must provide consent for children under 13; teens 13–15 can provide their own consent.||GDPR requires that parents provide consent for the processing of their children’s personal information in an online environment||Largely similar|
|Right of Disclosure or Access||Allows consumers to know what information is being collected and can get a copy of that information||Allows individuals to know how long their information will be held||Similar|
|Right of Data Portability||Consumers can exercise their right to data portability||Individuals can exercise their right to data portability||Similar|
|Right to Deletion/Erasure||CCPA provides for the right to deletion||GDPR provides for the right to be forgotten||Similar with certain differences such as the response time. Under CCPA, the response time is 45 days, while under GDPR, the response time is 30 days.|
|Right of Rectification||Does not provide for the right to rectification of personal information||Provides for the right to rectification||GDPR allows the right to rectification while CCPA does not|
|Right to Restrict Processing||CCPA only has the opt-out right for the sale of personal information||Provides for the right to restrict processing||Different|
|Right to Object to Processing||Only allows the right to opt out of the sale of personal information||Allows for the right to object to the processing of personal information||Different|
|Right to Object to Automated Decision-making||Not found under CCPA||Allows the right to object to automated decision-making||Different|
|Non-discrimination||Prohibits discrimination against individuals who exercise their privacy rights||Prohibits discrimination against individuals who exercise their privacy rights||Similar|
|Responding to Rights Requests||Provides for 45 days as the response time to rights requests||Provides for 30 days as the response time to rights requests||Similar but with different timelines for response|
|Penalties (Private Rights of Action)||CCPA provides for consumers’ private right of action||GDPR does not mention an individual’s private right of action.||Different|
|Penalties (Civil Fines)||Penalties applied per violation ($2,500–$7,500).
Consumer can sue the business for violation ($100–$750).
|Penalty based on annual global turnover (4% or €20 million)||Different|
Figure 1. Comparison of CCPA and GDPR.
What Is the CPRA?
In 2020, the California Consumer Privacy Act was enacted. The California Privacy Rights Act (CPRA) is an amendment to the CCPA that takes effect in January 2023 with enforcement activated in July 2023. The CPRA amends the CCPA to include more privacy rights for California residents. While the law mainly offers the same protections under the CCPA, it updates some of its provisions and introduces several others.
The CPRA establishes the California Privacy Protection Agency to be responsible for implementing and enforcing this law. It also retains the attorney general as the civil enforcement authority.
Sensitive Content Communications and the CCPA
Private sector businesses must track, control, and secure the digital communications of PII belonging to California residents to comply with the CCPA. Historically, businesses rely on numerous tools for sensitive content communications—siloed approaches for the different communication channels (email, file sharing, file transfer, managed file transfer, web forms, and application programming interfaces [APIs]). This creates a bifurcation of metadata that makes it difficult for organizations to institute centralized and automated governance of PII and to maintain an integrated risk management approach.
The Kiteworks platform consolidates digital communications of confidential data like PII into a Private Content Network. Kiteworks unifies, tracks, controls, and secures PII shared and sent into, within, and out of an organization, which helps ensure CCPA regulatory compliance.
For more information on how Kiteworks can create a Private Content Network for your organization, schedule a custom-tailored demo today.
Get email updates with our latest blogs news