CCPA is Leading the Way in Modern Consumer Protection
On January 1, 2020 a landmark policy will become the first of its kind in the United States. The California Consumer Privacy Act (CCPA) is leading the way in creating protections for consumers and restrictions for what companies can do with personal data. While the CCPA only applies to consumers in California, it will apply to companies that serve any consumers living in California, whether or not their operation is housed there.
After heavy negotiation and some alterations, the bill was passed in September of 2019 and will go into effect as of January 1st. The CCPA will primarily affect mid- to large-sized corporations that deal in the buying and selling of personal data. It enables consumers to request an organization disclose the categories and specific information they have collected on them, what the source of that data is, and what their purpose is in collecting the data. Consumers can opt out of the sale of their personal data and request that any and all data regarding them be deleted. Companies must then comply and cannot discriminate against an individual for their decision to opt out. In addition, consumers will retain the right to file lawsuits against them if they do not, in addition to the response from the Attorney General’s office.
While the CCPA is not restricted to California organizations, it does set specific guidelines on who will be held liable for the mishandling of data. To be required to comply, an organization’s annual gross revenue must be more than $25 million, they must share or sell personal information for more than 50,000 individuals, and earn more than 50% of their annual revenue from the selling of personal information. This will mean that most small business will not need to comply, but experts suggest this law will not be the last of its kind and will have resounding impacts on how companies, large and small, approach marketing and advertising.
Currently, most organizations take advantage of larger companies dealing in data and personal information, such as Facebook and Google, to run ads that are based on geo-location and/or demographic information they may not otherwise have access to. The CCPA will force organizations to rethink these strategies in California, and similar laws may begin to pop up, changing the face of marketing across the United States. In addition, the CCPA has a rather broad definition of personal information. This can include geo-location, demographic information, internet browsing history, and online preferences.
The best approach for an organization is to get ahead of the trend. Whether you deal in personal information or utilize services that do, a key place to begin is to create strategy in preparation of the CCPA and other laws of its kind. Implement policy and education to prepare your employees to handle the changes processes surrounding data and information. Ensure employees know what to do with data, how to adequately delete data, and who to speak to if they are unsure about the changes in handling personal information. The CCPA may not immediately apply to your organization but we are moving into a new world of data handling and as new laws arise, adequate policy and procedure will help you and your organization to get ahead of the game.