Insights
Publications

Is your company covered by California's new privacy law?

November 22, 2019 Articles
North Bay Business Journal

On Jan. 1, 2020, the California Consumer Privacy Act (CCPA), a consumer-friendly privacy law inspired by the European Union’s General Data Protection Regulation, will take effect.

The CCPA is aimed towards bolstering consumers’ privacy rights by instituting notice, retention, security, and other requirements related to collecting consumers’ “personal information,” defined broadly to include “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

For example, the CCPA potentially governs information collected from consumers for mailing and marketing lists, billing, satisfaction surveys, and other purposes.

Is your company covered?

To fall within the CCPA’s coverage, a for-profit business must meet only one of the following criteria: (1) annual gross revenues exceeding $25 million; (2) annual purchase, receipt for the business’s commercial purposes, sale, or sharing for commercial purposes, alone or in combination, of the personal information of 50,000 or more consumers, households, or devices; or (3) 50% or more of annual revenues derived from selling consumers’ personal information.

Any business (including a nonprofit) that does not directly meet one of the above-listed criteria may still be covered if it (1) controls or is controlled by, and (2) shares common branding with, a company meeting one of the above criteria.

Data collection notice requirements

The CCPA requires the disclosure of various information about data collection. Most notably, it calls for covered entities to notify consumers of “the categories of personal information to be collected and the purposes for which the categories of personal information shall be used.” This information must be provided “at or before the point of collection.”

For example, covered entities that collect consumer information (such as names and contact information) for mailing or marketing lists must, at or before the time the information is collected, explain to consumers what information it is collecting and how it will be used. If the entity wants to later use that information for a previously undisclosed purpose, the entity must notify affected consumers of the new purpose.

In addition to notice regarding the information collected, the CCPA also requires the disclosure of a consumer’s rights to (1) request disclosure of the personal information collected; (2) opt-out from the sale of the data; (3) request that data be deleted; (4) non-discrimination for the exercise of privacy rights; and (5) use an authorized agent to make privacy-related requests of the covered entity.

For information collected through the entity’s website, CCPA-required disclosures would be provided in the entity’s website privacy policy. It is therefore critical that companies evaluate and update their posted privacy policies prior to the new year.

Liability for security breaches

The CCPA establishes liability for certain security breaches involving the “unauthorized access and exfiltration, theft, or disclosure” of consumers’ personal information. In the event of a covered breach, each affected individual can recover between $100 and $750 in statutory damages.

Thus, damages can add up pretty quickly in class action lawsuits. The breach must result from “the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.”

The CCPA does not define “reasonable security procedure and policies,” but California’s attorney general provided some guidance in its February 2016 California Data Breach Report. Thus, covered entities should review their information security policies and practices to reduce the risk of a breach.

Application to employment-related data

Although the CCPA is expressly directed at consumer privacy, it also has implications for employment-related data.

“Personal information” may encompass many categories of data collected from employees, applicants, or other personnel, such as contact information; Social Security numbers; education and employment history; bank and financial information; medical, insurance, or benefits information; family and dependent information; photographs or recordings; and internet or computer activity records.

Assembly Bill 25 delays most of the CCPA’s application to employment-related data until Jan. 1, 2021. However, on Jan. 1, 2020, two provisions relating to such data will take effect for covered employers: (1) data collection notice requirements and (2) liability for security breaches.

Thus, covered employers may want to (1) review all online and hard-copy forms used to collect personal information, such as employment applications, new hire paperwork, and benefits enrollment materials, to ensure they provide CCPA-compliant notice; (2) develop a general privacy notice for new hires explaining what categories of data will be collected during their employment and how the data will be used; (3) review and update internal policies concerning the collection and use of personal information; and (4) train employees regarding CCPA requirements.

And, as with all covered entities, employers should carefully review their information security policies and procedures, and coordinate with their IT and HR departments, to reduce the risk of a security breach.

California Consumer Privacy Act full text, here.

Firm Highlights

Publication

Use Caution When Laying off Employees Without a Return to Work Date

Employers who have laid off workers in recent weeks due to the shelter-in-place orders should be aware of little-known requirements regarding final paychecks.  Even if employees are being furloughed with the expectation of returning to...

Read More
Publication

Going it Alone: How to Manage Cybercrime Response With Less Government Help

By: Jessica K. Nall, Chair, White Collar Defense and Corporate Investigations practice and Aviva J. Gilbert, Senior Associate, White Collar Defense and Corporate Investigations practice, Farella Braun + Martel [1] Several years ago when...

Read More
Publication

Families First Coronavirus Response Act - Posting Requirement for Employers

The recently enacted Families First Coronavirus Response Act (“FFCRA”) requires private employers with fewer than 500 employees to post a notice by April 1 summarizing the benefits available to employees under the FFCRA. For employers...

Read More
News

GDPR in 2020: What You Need to Know

In the article "GDPR in 2020: What You Need to Know," Nate Garhart discussed the newly clarified guidelines for extraterritorial application of GDPR. Read the full article on Toolbox , here .

Read More
Publication

Force Majeure and Contractual Non-Performance During the Coronavirus Pandemic

Never in the experience of most of us has an event so thoroughly interrupted business as usual as the coronavirus (COVID-19) pandemic. Everywhere, contract parties facing severe stress in their businesses are reassessing their contractual...

Read More
Publication

What California’s New Security Law Means to Your Business

Commonsense IoT security steps that startups and small business should consider to comply with California’s new law California recently enacted a new law, Senate Bill 327, that requires companies that make Internet of Things...

Read More
Publication

Data Scraping Under the Revised CCPA Regulations

On March 11, 2020, California Attorney General Xavier Barrera released a second revision to the draft California Consumer Privacy Act (CCPA) regulations . The new draft contains a number of important changes to the...

Read More
Publication

Trademark Office Deadlines and Coronavirus-Related Delays

With all of the business interruption caused by the COVID-19 pandemic, many worldwide trademark offices have taken steps to recognize the issues caused by the crisis. The offices in which applicants from the U.S...

Read More
Publication

CCPA Enforcement During COVID-19 Pandemic

The California Consumer Privacy Act (CCPA) that went into effect on January 1, 2020 provided for a grace period to allow companies additional time to come into compliance with the new regulation.  That grace...

Read More
Publication

Public Ends From Private Means: Privacy Rights and Benevolent Use of Personal Data

With the explosion of COVID-19 cases worldwide, companies and governments have expanded their interest in the use of the vast stores of consumer data. Even where such collection and use of personal data is ostensibly...

Read More