That’s the number of current California residents, and also the number of people who will soon have their personal data protected by the strongest state privacy legislation the US has ever seen.
The California Consumer Privacy Act (CCPA) will take effect on January 1, 2020, but how do you know if it applies to you? And what do you do if it does? This guide can help you prepare for the new law.
Having clear, transparent policies can help answer consumer questions and protect your business when the CCPA goes into effect. Download our Data Security Policy Template to get started.
What is the California Consumer Privacy Act?
Passed into law in June 2018, the CCPA aims to give California residents more control over their personal data. According to Californians for Consumer Privacy, the Act’s goals are to give residents the rights to:
- Tell businesses not to sell or share their personal information. Consumers can also request that a business delete their data.
- Protections against businesses that do not value privacy and keeping personal data safe. In addition, consumers are entitled to the same pricing and standard of service whether or not they exercise their rights under the Act.
Not only does California have millions of residents, but many of the world’s biggest tech companies (including Google and Facebook) are headquartered there. For this reason, the CCPA has potential to change the way the entire US handles data privacy.
So how do you know if the California Consumer Privacy Act applies to you? To better understand the Act, you first have to know some important definitions.
A consumer is defined as “a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations.”
A business is a for-profit entity that conducts business in California and collects consumers’ personal information and/or sells consumer data for business purposes. It does not have to be physically located in California. To fall under the CCPA, a business must also meet at least one of the following three criteria:
- Make at least $25 million in annual revenue
- Earn at least 50 per cent of its annual revenue by selling consumers’ personal information OR
- Possess personal data from at least 50,000 consumers
Perhaps the most confusing definition of the CCPA is personal information. The Act defines it as “a broad list of characteristics and behaviors, personal and commercial, as well as inferences drawn from this information.” Some of the specific types of data mentioned include:
- Personal identifiers (e.g. address, social security number, passport number)
- Commercial information (e.g. records of property purchased, purchasing history)
- Internet activity information and history
- Geolocation data
- Biometric data
- Education information
Steps to CCPA Compliance
Complying with the California Consumer Privacy Act doesn’t have to be difficult or stressful. Take these steps now to ensure your business is fully compliant by the new year.
Organize Your Data
Once the CCPA takes effect, consumers have the right to request reports on information that businesses have collected about them. In order to respond quickly and accurately, you’ll need an organized data storage system. Reevaluate your data inventories and strategies to streamline your process for answering these inquiries.
Update Policies and Procedures
Having clear, transparent privacy and data collection policies and procedures can help answer consumers’ questions as they adapt to the new law. Revise your policies to fit with the CCPA’s regulations, including outlining the new rights for California residents under the law and the categories of data that your business collects and why.
Update your business’s procedures to guarantee these new consumer rights fit seamlessly into your everyday operations. Train employees on how to handle information report and deletion requests, as well as opt-outs. Most importantly, make sure anyone who handles data knows and understands the specifics of the CCPA.
Improve Data Security
Under the CCPA, businesses must protect consumer data with “reasonable” security. To do this, take a risk-based approach when addressing threats to the confidentiality, integrity and availability of personal information you collect. Assess these threats and rank them according to risk level, then work toward resolving the highest-risk threats first.
Use Case Management Software
Case management software can help your business manage risk by detecting compliance problems early, allowing you to address them quickly. Choose a solution with a robust reporting tool for a fast, complete look at problem areas and trends.
Because you’re dealing with sensitive data, case management software with role-defined access is better for complying with the CCPA than spreadsheets or other solutions. The ability to control who can access what consumer information improves privacy and, therefore, compliance.
Want to learn more about how case management software can help you manage data security investigations? Download our free eBook.