At PMA, we strive to stay ahead of the curve when it comes to business trends and technological advances that benefit our clients (and clients-to-be!). Many of our clients that do business globally were concerned with the GDPR, specifically who needs to comply, and what compliance means for the average business owner. Our recommendation at the time was to seek legal advice, so your business is protected.
We are once again hearing from our clients, rumblings over the new California privacy law (CCPA), coming into effect in January 2020. What does this mean to you? What are the regulations, who needs to comply, and what does compliance look like?
There’s a lot of great information available, and a lot of misinformation muddying the waters. For this reason, we wanted to share this incredible article by Peter Hoppenfeld, Strategist, Advisor & Attorney At Law,
www.peterhoppenfeld.com.
We hope you find this article as helpful as we did!
_________________________________________________
The Basics
For-profit businesses that collect or use personal information, do business in California, and meet certain thresholds (related to revenue and data collection) may be required to comply with CCPA.
Do you (and your business) have to comply with CCPA?
The answer is YES, if:
You are a for-profit business that does business in California;rnYour business collects personal information from California consumers;rnYour business determines the purposes and means of processing that personal information of California consumers;rnAND you meet or exceed one of the following requirements, as set forth in the Act:
Your business has $25,000,000 in annual gross revenues; orrnYour business buys, sells, shares, and/or receives the personal information of at least 50,000 California consumers (that’s just 137 clicks per day from unique CA visitors), households (still not a fully defined term), or devices (very important, as a single consumer might have multiple devices) per year; orrn50% of your business’s annual revenue is derived from selling the personal information of California consumers (NOTE: this is relevant if you have a strong affiliate marketing presence)rnIf you answered YES, CCPA will apply to your business.
CCPA applies to me. Now what?
Consumers may request to opt-out from sale of personal information. In order to comply, you should:
Place a “Do Not Sell My Information” link on websiternComply with the requestrnNot seek reauthorization for 12 monthsrnNot discriminate against opted out consumersrnUnder CCPA, consumers may also request:
Disclosure of personal information, including:rnHow it was collectedrno How it is used
o Any third parties with whom it has been shared
Data portability in a usable format that the consumer can transmit to another entityrnDeletion of personal information (there are some exceptions to your requirement to comply, such as if you need to retain the information in order to complete a transaction on behalf of that client, or to comply with a specific legal obligation).rnIn broad strokes, here’s what you have to do to prepare:
You have to have a way to receive and respond to data subject access requests, track those requests, and make sure they are being fulfilled. Some companies are choosing to implement this across the board, and not just to California clientsrnEnsure that data is only shared with parties that have a purpose for receiving the information. Make sure that sensitive data is handled with an even greater degree of confidentiality.rnComply with consumer requests.rnIn order to prepare to comply with these requests, you should:
Map your datarnMake sure your technology supports your ability to complyrnReview and revise agreements with third partiesrnTrain your teamrnAmend your privacy noticernYou should also take the following actions to be prepared to accommodate these consumer requests:
Make consent at least as easy to withdraw as it was to givernHave two or more methods for consumers to submit requests, such as: a toll-free telephone number and website addressrnDon’t discriminate against consumers who have exercised their rights, such as by charging them more or offering them lessrnComply with verifiable consumer requestsrnRespond to a request within 45 daysrnInstruct all third parties with whom you have shared the consumer’s personal information to comply with the request, as wellrnBest practices would dictate that you implement these measures with respect to all consumers, not just those who you believe to be from California (i.e., geotracking by IP address won’t help you when you have a California resident accessing your site or service from another state).
What about sharing information with third parties?
CCPA doesn’t require you to stop sharing consumer information with third-party vendors and advertisers, but you do have to:
Know all of the third parties with whom you share informationrnInform your consumers that you share their information with third partiesrnStop sharing with these parties when a consumer asks you toornIf you are obligated to comply, you are also obligated to ensure that all of your third-party service providers use and process the information that you share with them in a way that enables you to be compliant (for instance: they only use the information to perform their contracted task, they delete information upon request, etc.).
What if I said NO to the questions above?
If you answered NO based on the above information, but still wish to provide a disclosure related to CCPA to your customers, we can provide you with an amended Privacy Policy, much in the way that we did in advance of the effective date of GDPR.
Even if CCPA doesn’t apply to you now, it might in the future. Are you a growing company? Do you have unique website visitors? Do you have a growing population of consumers in California? If so, you might consider implementing the same above compliance tactics as mandated for those companies that do fall within CCPA.
Peter Hoppenfeld, Strategist, Advisor & Attorney At LawrnRachel Leeds Edelman, Certified Information Privacy Professionalrn________________________________________________________
What’s the takeaway from this? If you’re not sure whether the CCPA applies to your business, or if you want to get ahead of the compliance regulations that are undoubtedly due to be similarly implemented across the country, we highly suggest you seek legal advice on the best way to move forward for your business.
By Peggy Murrah, Founder of PMA Web Services