Insights
Publications

Is Your Wine Business Ready for the California Consumer Privacy Act?

April 25, 2019 Articles

Companies within and outside the State of California who offer products and services to California residents are focusing on what they need to do to comply with the new California Consumer Privacy Act of 2018 (CCPA), which will come into effect January 1, 2020.

Companies in the wine industry are no different. By turning attention to the issue now, your wine company can be ready for the new law without significant disruption of business.

Are you subject to the law?

A California wine company should start by determining whether the requirements of the law will actually apply to it. The act applies to for-profit companies that

  • have annual gross revenues in excess of $25 million; or
  • receive or sell/share the personal information of 50,000 or more California residents, households, or devices; or
  • derive at least 50% of their annual revenues from selling the personal information of California residents.

While we can assume that the third of these criteria doesn’t apply to many wine companies, the first two will likely make many subject to the law.

It is important to note that the law applies and gives California residents privacy rights even vis-a-vis a company that is not itself located within California unless “every aspect of . . . commercial conduct takes place wholly outside of California.” This would require that, for a given California resident claiming rights under the act,

  • the information was collected from the consumer while s/he was outside of California;
  • no part of any sale of the personal information occurred in California; and
  • no personal information collected while the consumer was in California was sold.

To be sure, it is very unlikely that businesses selling goods and services to California residents will be able to avoid application of the law.

What does the Act require?

While much more could be said on this topic and the devil is in the details, the CCPA provides consumers with four basic rights relating to their personal information:

  • The right to know what personal information is being collected and what is being done with that information;
  • The right to “opt out” of the sharing of personal information;
  • The right to control personal information and have collected information deleted; and
  • The right to not be prejudiced even if exercising rights under the act.

What is “personal information?”

Personal information as defined by the CCPA includes traditional forms of information that identify individuals (names, email addresses, etc.), and also non-traditional examples including IP addresses, geolocation information, and unique identifiers such as device IDs, cookie IDs, and internet activity information (browsing and search history). Additionally, inferences drawn from such personal information “to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes” would also amount to personal information subject to the rights under the CCPA.

What needs to be done to get ready?

At this time companies should be discussing the issues with stakeholders within the company, primarily those interested in collecting and using the information — the marketing department — and those that control the technical collection of data — the IT department. It is important that both stakeholders provide input and understand the issues as it is common for systems to collect information that, for example, marketers were not actually looking to collect.

Once it is clear what information is being collected and what is being done with that information, the privacy policy and other disclosure documents and links need to be drafted and included on the site to comply with the company’s disclosure obligations under the CCPA.

The IT department must also be engaged to ensure that the company can respond to consumers’ requests for information and/or to be forgotten. While seemingly simple, this often requires steps to be taken to create or optimize the ability to do so.

Once the privacy policy and required disclosures are posted and the company has a plan and process to respond to consumer and regulator requests concerning personal information, January 1, 2020 will present only the chance to toast the opportunities of the new year rather than worry about the effective date of the CCPA.

Firm Highlights

Publication

Court Reinstates CPPA Enforcement Authority and Confirms No Delay Necessary for Enforcement of Future CCPA Regulations

A recent appellate decision has made clear that the regulations promulgated under California’s groundbreaking consumer privacy law, the California Consumer Privacy Act (CCPA, as amended by the California Privacy Rights Act (CPRA)), are ripe...

Read More
Publication

BIPA Liability: Existing CGL Coverage May Provide a Lifeline for Policyholders

Developments in the law have increased the potential liability that companies could face under the Illinois Biometric Information Privacy Act (BIPA), but fortunately for policyholders, Illinois case law has also solidified coverage for BIPA...

Read More
Publication

California AI Proposal Rethinks Consumer Scope and Recordkeeping

The California Privacy Protection Agency will revisit its  draft  regulations for automated decision-making technology on March 8, including use of artificial intelligence to process personal information. Comment periods should be coming soon in 2024...

Read More
Publication

Enforcement of CPRA Regulations Delayed

Shortly before the California Privacy Right Act (CPRA) modifications to the California Consumer Privacy Act (CCPA) were set to become enforceable on July 1, 2023, a Sacramento Superior Court judge issued a ruling on...

Read More
Publication

It Wasn’t Me, It Was the AI: Intellectual Property and Data Privacy Concerns With Nonprofits’ Use of Artificial Intelligence Systems

In today's rapidly changing technological landscape, artificial intelligence (AI) is making headlines and being discussed constantly. To be sure, AI provides a powerful tool to nonprofits in creating content and exploiting for countless cost-effective...

Read More
Publication

Nonprofits’ Use of Artificial Intelligence Systems: Intellectual Property and Data Privacy Concerns

In today's rapidly changing technological landscape, artificial intelligence (AI) is making headlines and being discussed constantly. To be sure, AI provides a powerful tool to nonprofits in creating content and exploiting for countless cost-effective...

Read More
Publication

California Appeals Court Empowers Privacy Agency to Immediately Enforce CCPA Regulations

In  California Privacy Protection Agency et al. v. The Superior Court of Sacramento County  (case number C099130), the Third Appellate District of the California Court of Appeal returned authority to the California Privacy Protection...

Read More
Publication

Top 5 Privacy Cases To Watch, From Chatbots to Geolocation

Litigation — and threats of litigation — related to privacy law violations have been on the rise recently. While some judges have pushed back on the theories set forth by plaintiffs, new privacy lawsuits...

Read More
Publication

Thomson Reuters v. Ross Intelligence: AI Copyright Law and Fair Use on Trial

On Sept. 25, 2023, Judge Stephanos Bibas (sitting by designation in the District of Delaware), determined that fact questions surrounding issues of fair use and tortious interference required a jury to decide media conglomerate...

Read More
Publication

California Proposes New AI & Automated Decision-Making Technology Regulations

The California Privacy Protection Agency (CPPA) released its draft  regulatory framework for automated decision-making technology (ADMT) on November 27. These regulations are a preview of what new requirements may look like for companies currently...

Read More