by Yana A. St. Clair, Esq.
What California companies must do to comply.
Welcome back to our discussion on the California Consumer Privacy Act, or CCPA! In our last article, we introduced you to California’s shiny and new data protection law, and provided you, as the consumer, with an outline of all the rights and privileges that this legislation entitles you to. Now, we will shift our focus to the Business side, and examine what responsibilities and obligations the companies collecting personal information (PI) are required to comply with and abide by.
First off, the CCPA defines a business as:
A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers’ personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information, that does business in the State of California, AND that satisfies one or more of the following thresholds:
(A) Has annual gross revenues in excess of twenty-five million dollars ($25,000,000), as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185
(B) Alone or in combination, annually buys, receives for the business’ commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices
(C) Derives 50 percent or more of its annual revenues from selling consumers’ personal information
Before we delve into what the covered entities owe to consumers, it is curious to point out that the law’s rather specific prongs and high thresholds result in the exclusion of a great deal of companies.
The CCPA requires all companies under its control to disclose to consumers, generally in a privacy statement, all of the following:
- Categories of Personal Information collected
- Sources from which Personal Information is collected
- Purpose for which Personal Information is collected
- Categories of third parties with which Personal Information is shared
- Specific pieces of Personal Information collected
But overall, businesses MUST notify consumers of their rights under the CCPA!
Now all of this seems pretty straightforward, right? The CCPA gives the consumer certain rights that the business has to honor, and further, the business itself, is required to notify the consumer of his or her rights.
But herein lies the problem, the language and framing of the document allow too much leeway for ambiguity, and give businesses an opportunity to take advantage of the ample loopholes that the CCPA provides…
Further, straight on the face of the legislature it is apparent that the law puts entirely too much burden on the consumer, and bearing in mind the sophistication of the attorneys representing the business and drafting their privacy statements, we can foresee that at the end of the day many a not so tech savvy consumers will be taken advantage of. As I write this article the CCPA’s have already gone into effect, and we will soon be able to answer some of these questions and overall ascertain the degree of the new law’s efficacy. Until next time!
Biography
Yana is an American attorney licensed to practice in all State and Federal courts of California. Yana holds a Bachelor of Arts Degree in Political Science specializing in International Relations from UCLA, the Degree of Juris Doctor from Loyola Law School, and a Masters of Business Administration Degree from Ashford University. Since the beginning of her undergraduate studies, Yana has been involved in various aspects of the field of Electrical Engineering, where she employs her business and legal knowledge to consulting and advising businesses and individuals on relevant topics of concern. Yana also serves as Editor for PACWorld magazine, having been with the publication since its inception. As an attorney, Yana specializes in criminal defense, where she devotes her talents and expertise to fighting for her clients’ rights and freedom.
