Prepare for California Consumer Privacy Act (CCPA)

Definition of CCPA

CCPA is a state-wide data privacy law that regulates how businesses can handle personal data of California residents. It was introduced on January 1, 2020, and is the first law of the kind in the United States.

 

Who is covered under CCPA?

Any for-profit entity that does business in California and collects, sells, or shares consumer data and,

·       Has annual gross revenue exceeding 25 million, or

·       Possesses personal information of 50,000 or more consumers, or

·       Earn more than half of annual revenue by selling consumer’s personal information

 

How does the regulation work?

Under the regulation, Californians are allowed to sue companies for failing to prevent data breaches and prevent personal data from being misused. Californians can also opt-out of sharing their data with companies under the regulation.

 

CCPA requirements

To comply with CCPA, one has to:

        Identify and classify data assets

        Find out where the CCPA personal information is located and stored

        Determine the risky data and check access permissions

        Locate personal data that is stale

        Adjust required permissions

        Deploy role-based access controls

        Delete stale personal data

        Monitor personal data against threats

        Review data permissions continually

        Adjust protocols against cyber threats

        Organize relevant data

 

Consequences and Penalties for violations

There are two types of penalties for violations:

        Civil penalties

        Private Right of Action

Civil penalties

Civil penalties for CCPA violation includes:

        2500 for non-intentional violation

        7500 for intentional violation

Any business that cures its noncompliance within 30 days of being notified does not need to pay the penalties. However, some noncompliance cannot be cured.

Private Right of Action

        $100 to $750 per customer per incident, or actual damages whichever is greater

        Relief that courts deem to be proper

        Declaratory or injunctive relief

 

Benefits and drawbacks of CCPA

Benefits:

        Greater transparency from companies

        Customers have the right to know about all data collected about them and will be able to request this data for free twice per year

        Customers have the right to opt-out of getting data sold

        Customers can request the data to be deleted, can sue companies if their data is stolen, and can stand against identity theft

        Businesses get a competitive advantage that compliance brings

Drawbacks:

        Regulatory compliance with CCPA means businesses need to get more work done to ensure compliance

        CCPA can be costly to businesses

        Customers can request businesses to either completely delete their data or keep all of it, a choice which is not always the customer’s choice

 

Best Practices for Complying with the CCPA

The best practices for CCPA compliance are:

        Create an internal privacy framework that lays out how you will comply with CCPA

        Do more with less data, by minimizing the data you collect, store, use and transmit

        Automate compliance tools for data mapping tools, data protection, managing consent

        Be specific about the posture of your internal and external privacy

Additional Resources for Further Investigation

Refer to the original CCPA link to get additional details about CCPA regulations.

 

Conclusion

Conforming to CCPA standards does not have to be much of a hassle. Databrackets is here to help. Our experts and consultants can help you get a cost-effective CCPA readiness assessment, so you can focus on profitability rather than wasting your time on understanding the ins and outs of CCPA to the core. Schedule a consultation with us today!