Understanding the California Consumer Privacy Act (CCPA)

Who must comply with the CCPA?

The CCPA's obligations apply to a business, which it defines as a for-profit entity (including a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity) that:

• Collects a consumer's personal information (directly or on its behalf) and determines the purposes and means of processing (alone or jointly with others).
• Does business in California and meets one of the following thresholds:
  • annual gross revenue that exceeds $25 million (adjusted for inflation);
  • annually buys, receives, shares, or sells the personal information of more than 50,000 consumers, households, or devices for commercial purposes (alone or in combination); or
  • derives 50% or more of annual revenues from selling consumers' personal information.

The CCPA provides numerous exceptions to its application based on:

• Jurisdictional concerns, such as when:
  • every aspect of commercial conduct takes place wholly outside of California;
  • completing a single, one-time transaction that does not retain collected personal information; or
  • another sector-specific privacy or data protection law covers the conduct, such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Fair Credit Reporting Act (FCRA), or the Gramm-Leach-Bliley Act (GLBA).

• Common business operation needs, such as to allow the sale of personal information as part of a larger merger or acquisition transaction.
• Legal or conflicts of laws issues, such as to comply with other laws, defend legal claims, or cooperate with law enforcement.

Consumer rights under the CCPA

The CCPA grants consumers several rights, including:

• The right to know about how the business collects, uses, and shares their personal information, including on request:
  • individualized privacy notice disclosures from the business; and
  • the specific pieces of their personal information the business holds.
• The right to delete personal information the business holds about them, subject to specific exceptions.
• Personal information sale prevention rights. For consumers:
  • age 16 or older, the right to opt out of personal information sales; and
  • age 15 or younger, the right to opt in to personal information sales.
    
• The right to non discrimination for exercising their CCPA rights.

Business obligations under the CCPA

The numerous consumer rights granted by the CCPA obligate businesses to take several measures to comply with its requirements. Businesses should review their data inventory, collection, and sharing practices to determine which sections of the CCPA apply to their businesses, particularly if they sell consumer personal information.

To meet its CCPA obligations, a covered business should:

• Protect personal information by implementing reasonable security practices and procedures appropriate to the relevant risks.
• Make all required CCPA notice disclosures, including:
  • notices at collection;
  • a CCPA privacy policy;
  • personal information sales opt-out right notices and links; and
  • financial incentive notices, if offered.
• Honor consumers' CCPA rights and establish internal procedures to receive, verify, and respond to consumer rights requests.
• Review all price, service, or quality differences relating to the collection, retention, or sale of personal information to ensure non-discrimination.
  
• Comply with employee training and record-keeping requirements.
• Review service provider and third-party personal information data sharing contracts for alignment with the CCPA's requirements.

CCPA enforcement

The CCPA grants regulatory and enforcement authority to the California Attorney General (AG). Before initiating an action for a CCPA violation, the California AG must give the offending business, service provider, or other person notice of the alleged violation and at least 30 days to cure it. If the business does not—or cannot—cure the violations, the California AG may seek civil penalties up to either:

• $2,500 per violation
• $7,500 per intentional violation

While unclear, these civil penalties likely extend to each affected individual and may result in large aggregate fines.

CCPA private right of action

The CCPA extends California's data breach laws by creating a private right of action for unauthorized access, theft, or disclosure of certain non-encrypted and non-redacted personal information. Importantly, the data breach liability section defines personal information much more narrowly than the general CCPA definition and ties it to part of the California data breach notification statute's definition.

The narrow subset of personal information covered in the private right of action may lead to situations where an entity must provide notice of a data breach but does not face a CCPA private right of action, or vice versa.

The potential damages a consumer may seek in a CCPA private action include:

• Either statutory damages between $100 to $750 per California resident and per incident, or actual damages, whichever is greater.
• Injunctive or declaratory relief.
• Any other relief a court deems proper.

However, statutory damages are only available if, before filing a data breach lawsuit:

• The consumer provides the business with a written notice identifying the specific CCPA violations and a 30-day period to cure those violations, if possible.
• The business does not—or cannot—cure the alleged violation and does not provide the consumer with an express written statement within the 30-day period that:
  • it has cured the violation; and
  • no further violations will occur.

If the business continues with its alleged violations, the consumer can file a lawsuit requesting statutory damages for the original violation and any new CCPA violation occurring after the notice, including breaching the written statement.

Looking ahead: 2020 ballot initiative to expand the CCPA

A new ballot initiative for a voter-enacted statute called the California Privacy Rights Act of 2020 (CPRA) will appear on the November 3, 2020 ballot as Proposition 24. If passed, the CPRA, among other changes, will expand the CCPA's personal information protection rights and business obligations, particularly around sensitive information like precise geolocation data, provide transparency around automated decision making, and create a dedicated privacy protection agency in California. It also contains a one-way rachet amendment process that allows legislature-initiated amendments that improve consumer privacy but requires a new ballot initiative to reduce privacy protections.

For a more complete treatment of this issue, please read the Practical Law resource Understanding the California Consumer Privacy Act (CCPA) Practice Note, one of more than 65,000 resources available through Practical Law and Practical Law Connect. Get a free trial of Practical Law today.