Why Does the California Consumer Privacy Act Matter to Me?

The California Consumer Privacy Act (“CCPA”) will become effective on January 1, 2020.  Any entity that has personal information about California consumers – i.e. if your business has California customers, employees, or contacts – may be covered by this law.  Now is the time to investigate whether the law applies to your business and, if it does, what to do to prepare.

The CCPA creates a number of disclosure requirements.  For example, the CCPA requires businesses to disclose all of the types of personal information they collect and the purposes for which it will be used.  Businesses must also notify consumers about their rights under the CCPA and provide at least two methods for consumers to exercise those rights, one of which must be a toll-free number.

The CCPA provides California consumers with certain rights with respect to their personal information.  These include, among others, the right to (a) obtain a copy of the specific personal information collected about them for free, (b) find out what categories of personal information the business sells or discloses to others, and (c) require that the business delete all of their personal information.  The CCPA also gives consumers the right to direct a business not to sell their information.  To comply, a business is required to place a “conspicuous” link on its homepage titled “Do Not Sell My Personal Information” that links to a webpage enabling consumers to opt out of the sale of their information.

While the CCPA provides no private right of action for violation of its own terms, it empowers the California Attorney General to enforce the Act, after providing notice of a violation and an opportunity for the business to fix any violations. Currently, there are a number of proposed amendments pending in the California legislature that, if adopted, could significantly change the CCPA.  These include limiting the businesses to which it applies, clarifying various requirements, and changing other portions of the law.  FVLD attorneys are watching these amendments closely.  Businesses should consult their legal counsel to determine if CCPA applies to them, and what actions they need to take before January 1, 2020 so that they can avoid unnecessary legal problems.