The California Consumer Privacy Protection Act of 2018 (“CPPA”) is arguably the most comprehensive - and complex - data privacy regulation in the United States.  The CCPA was designed to emulate the European General Data Protection Regulation (“GDPR”) in many respects.  As a result, United States companies that thought they were not subject to the GDPR are now laser focused on the requirements of the CCPA and rushing to verify that their practices comply with the statute.  While the CCPA was drafted with an eye towards the GDPR, it also differs from that regulation in many respects.  As a result, companies that just finished their push to come into compliance with the GDPR now also must redirect their attention toward the CCPA.

To help address the confusion caused by the CCPA, Bryan Cave Leighton Paisner is publishing this multi-part Practical Guide to the California Consumer Privacy Protection Act.  

Quick Overview

A privacy notice (sometimes referred to as a privacy policy) is a document provided by a company to data subjects that include, among other things, a description of what types of personal data the company collects, how the company uses data, with whom the company shares data, and how the company protects data.

The CCPA requires that a business informs Californians about whom it has collected information about the organization’s privacy practices.  The privacy notice should be given “at or before the point of collection” of the information.

Comparison to Other Privacy Laws

Prior to the enactment of the CCPA there were several laws within the United States and within other countries – most notably the European GDPR – that required companies to publish a privacy notice.  The CCPA differs from those laws in the following respects:

• Unlike United States federal laws that require privacy notices, the CCPA applies to a broader group of companies that is not limited to distinct industries (e.g., financial sector or health care).
• Unlike United States state laws that require privacy notices, the CCPA
  • Applies to the collection by a business of personal information online and offline.
  • Requires companies to provide a greater degree of granularity concerning how the company uses and processes the personal information it collects.
  • Requires that businesses notify individuals about more extensive rights to access the information that the business holds about them.
  • Requires that businesses notify individuals about more extensive rights to have their information deleted.
  • Requires that businesses include a “Do Not Sell My Personal Information” link on their websites and in their privacy notices.
  • Requires that businesses describe the information that they share with service providers.
  • Requires that businesses describe the types of entities to whom they sell information.
• Unlike the GDPR, the CCPA
  • Requires that businesses include a “Do Not Sell My Personal Information” link on their websites and in their privacy notices.
  • Requires that businesses describe the information that they share with service providers.
  • Requires that businesses describe the types of entities to whom they sell information.

To Do List

• Review existing privacy notices and verify that they meet each of the new requirements of the CCPA.
• Identify instances in which you may be collecting information about Californians and do not currently have a privacy notice.
• In such situations, draft a privacy notice that conforms with both the CCPA and other privacy laws that may apply (g., the GDPR).

How We Can Help

BCLP looks at privacy notices like regulators and class action plaintiff’s attorneys look at privacy notices– with an eye toward spotting inconsistencies, errors, and facial violations of the law.  We also bring to bear a deep understanding of how other organizations have addressed the challenges of conveying complex privacy concepts in a simple outward facing document.  We can validate that a privacy policy –whether it was originally drafted to comply with United States or European law – complies with all of the new requirements of the CCPA.  You can find out more about how we draft and review privacy notices here.

Cross References

[View source.]