Insights
Publications

Is your company covered by California's new privacy law?

November 22, 2019 Articles
North Bay Business Journal

On Jan. 1, 2020, the California Consumer Privacy Act (CCPA), a consumer-friendly privacy law inspired by the European Union’s General Data Protection Regulation, will take effect.

The CCPA is aimed towards bolstering consumers’ privacy rights by instituting notice, retention, security, and other requirements related to collecting consumers’ “personal information,” defined broadly to include “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

For example, the CCPA potentially governs information collected from consumers for mailing and marketing lists, billing, satisfaction surveys, and other purposes.

Is your company covered?

To fall within the CCPA’s coverage, a for-profit business must meet only one of the following criteria: (1) annual gross revenues exceeding $25 million; (2) annual purchase, receipt for the business’s commercial purposes, sale, or sharing for commercial purposes, alone or in combination, of the personal information of 50,000 or more consumers, households, or devices; or (3) 50% or more of annual revenues derived from selling consumers’ personal information.

Any business (including a nonprofit) that does not directly meet one of the above-listed criteria may still be covered if it (1) controls or is controlled by, and (2) shares common branding with, a company meeting one of the above criteria.

Data collection notice requirements

The CCPA requires the disclosure of various information about data collection. Most notably, it calls for covered entities to notify consumers of “the categories of personal information to be collected and the purposes for which the categories of personal information shall be used.” This information must be provided “at or before the point of collection.”

For example, covered entities that collect consumer information (such as names and contact information) for mailing or marketing lists must, at or before the time the information is collected, explain to consumers what information it is collecting and how it will be used. If the entity wants to later use that information for a previously undisclosed purpose, the entity must notify affected consumers of the new purpose.

In addition to notice regarding the information collected, the CCPA also requires the disclosure of a consumer’s rights to (1) request disclosure of the personal information collected; (2) opt-out from the sale of the data; (3) request that data be deleted; (4) non-discrimination for the exercise of privacy rights; and (5) use an authorized agent to make privacy-related requests of the covered entity.

For information collected through the entity’s website, CCPA-required disclosures would be provided in the entity’s website privacy policy. It is therefore critical that companies evaluate and update their posted privacy policies prior to the new year.

Liability for security breaches

The CCPA establishes liability for certain security breaches involving the “unauthorized access and exfiltration, theft, or disclosure” of consumers’ personal information. In the event of a covered breach, each affected individual can recover between $100 and $750 in statutory damages.

Thus, damages can add up pretty quickly in class action lawsuits. The breach must result from “the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information.”

The CCPA does not define “reasonable security procedure and policies,” but California’s attorney general provided some guidance in its February 2016 California Data Breach Report. Thus, covered entities should review their information security policies and practices to reduce the risk of a breach.

Application to employment-related data

Although the CCPA is expressly directed at consumer privacy, it also has implications for employment-related data.

“Personal information” may encompass many categories of data collected from employees, applicants, or other personnel, such as contact information; Social Security numbers; education and employment history; bank and financial information; medical, insurance, or benefits information; family and dependent information; photographs or recordings; and internet or computer activity records.

Assembly Bill 25 delays most of the CCPA’s application to employment-related data until Jan. 1, 2021. However, on Jan. 1, 2020, two provisions relating to such data will take effect for covered employers: (1) data collection notice requirements and (2) liability for security breaches.

Thus, covered employers may want to (1) review all online and hard-copy forms used to collect personal information, such as employment applications, new hire paperwork, and benefits enrollment materials, to ensure they provide CCPA-compliant notice; (2) develop a general privacy notice for new hires explaining what categories of data will be collected during their employment and how the data will be used; (3) review and update internal policies concerning the collection and use of personal information; and (4) train employees regarding CCPA requirements.

And, as with all covered entities, employers should carefully review their information security policies and procedures, and coordinate with their IT and HR departments, to reduce the risk of a security breach.

California Consumer Privacy Act full text, here.

Firm Highlights

Publication

A Roadmap to Litigating Privacy Claims? A Look at a Recent Order From the Google Assistant Privacy Litigation

As privacy-related litigation continues to heat up, Judge Beth Freeman (ND Cal.) recently laid out in In re Google Assistant Privacy Litigation (Case No. 19-cv-04286) [1] a potential roadmap for surviving or winning a...

Read More
Publication

Twists in the Plot: California AG Releases Final CCPA Regulations

With a little time to consider the  finalized California Consumer Privacy Act regulations  released by the California Attorney General on August 14, 2020, it is clear that some last-minute negotiations (or perhaps just some...

Read More
Publication

Electric Fence: Protecting Proprietary Rights in Collected Energy Data

Like companies in other industries, a growing number of modern energy-related companies are focusing their efforts on data collection and analysis. For example, Enphase – an energy technology company – regularly tracks data about how...

Read More
Publication

Reopening Businesses Must Consider Employee and Consumer Privacy

While we’re far from returning to the “normal” that predated the COVID-19 pandemic, states have begun to relax lockdown requirements and some previously “nonessential” businesses are returning to operations. Along with these openings, governmental...

Read More
Publication

How Antitrust and Unfair Competition Laws Affect Platform Providers’ Relationships With ISVs, API Developers, and Scrapers

A wide variety of business and consumer platforms host mutually beneficial ecosystems. But these ecosystems are also fraught with antitrust risk that arises when platforms try to terminate or modify the terms of third-party...

Read More
Publication

Privacy During Bankruptcy Proceedings: Why It Matters

During these particularly trying times resulting from the COVID-19 pandemic, businesses of all sizes have been concerned about the future. As a result, considering potential liquidation or restructuring through bankruptcy is inevitably starting to...

Read More
Publication

Zoom Successfully Addresses New York’s Privacy and Security Concerns

A few weeks ago on this blog, we addressed some of the legal issues that have arisen for Zoom , as it becomes a significant part of American daily life during the COVID-19 pandemic. ...

Read More
News

Prop. 24 Passes: What Companies Need To Know About the New Privacy Law

Nate Garhart spoke to the San Francisco Business Times on the steps companies can take to prepare for the California Privacy Rights Act (CPRA). He noted that if the CPRA applies to your business, then...

Read More
Publication

Three Steps Licensees Can Take to Protect Their IP Rights in Bankruptcy

During periods of widespread economic disruption such as the present, operating businesses must be able to identify and respond to threats to the financial health of their contracting counterparts in order to protect key...

Read More
Publication

Proposition 24: California’s Ever-Evolving Privacy Landscape

Next Tuesday is election day, and this year, California voters are deciding whether to support another statewide privacy initiative – the California Privacy Rights Act (CPRA) (Proposition 24).  This measure would expand on the...

Read More