Cybersecurity Lawyer ForumCalifornia Consumer Privacy Act of 2018 – How You Can Prepare
On June 28, 2018, Governor Brown signed the California Consumer Privacy Act of 2018, which goes into effect on January 1, 2020. But – because of certain look-back features in the new law – significant compliance will be required by January 1, 2019.
The Act is enforceable by the California Attorney General and authorizes a civil penalty up to $7,500 per violation.
Observers estimate that about 500,000 companies nationwide will need to comply with the California Consumer Privacy Act. The California Attorney General is expected to aggressively enforce the Act – and it will have the budget to do so. Consumer watchdogs and plaintiffs class-action lawyers will also be on the hunt for violators.
__________________________
This is a serious law and violations will have serious repercussions for your bottom line and your reputation.
__________________________
The Act provides many of the same consumer privacy protections as the European Union’s General Data Protection Act (GDPR). JMBM’s Cybersecurity & Privacy Group has counseled dozens of companies on GDPR compliance and is now discussing California’s new law with clients; we are eager to help you assess your own compliance and protect your business from expensive liability and litigation.
Some key points:
What does the Act do?
The new act says that California residents, including minors, who give personal data of almost any kind to a for-profit business, have the right to know how the data is being used, have it deleted, know who the data is being sold to, and object to the sale of their data. In short, California consumers now own their personal information and have a significant measure of control over it. It is important to note that personal data includes almost any data that can identify an individual, not just financial data.
Who is subject to the Act?
The California Consumer Privacy Act applies to any for-profit business that:
- Does business in the state of California;
- Collects consumers’ personal information (or is the entity on whose behalf such information is collected) and determines how that information is collected and processed;
- Meets one or more of the following thresholds: has annual gross revenues in excess of $25 million; buys, receives, sells, or shares the personal information of 50,000 or more consumers, households or devices; or, derives 50% or more of its annual revenue from selling consumers’ personal information. The Act applies to small and mid-sized businesses, not just large companies.
What happens if a company does not comply?
The act is enforceable by the California Attorney General and authorizes a civil penalty up to $7,500 per violation.
In the event of a data breach, California residents will have a private right of action to recover up to $750 per incident, or actual damages. The statute directs courts to consider the nature, seriousness, persistence and willfulness of an incident, the number of violations, the length of time over which the incident occurred, and the violating company’s assets, liabilities and net worth.
Because of the minimum recoverable amount, consumers do not have to prove actual damages, only that there was a violation of the act.
What do you need to do now?
California businesses will need to take several steps to achieve compliance, including:
- Adopt a method for handling consumer requests for personal information.
- Develop templates and procedures for responding to consumer requests.
- Develop procedures for collecting and processing data.
- Identify and document the legal basis for collecting and processing personal information, in order to respond to the consumer’s right to have their information deleted.
- Make appropriate changes to public-facing website disclosures, including adding a description of consumers’ rights under the Act, listing the categories of data collected, and including a conspicuous way for consumers to indicate that they do not want their data sold.
What should you do now?
Contact us to discuss whether this new act applies to you, and how you should prepare for it. This is a serious law and violations will have serious repercussions for your bottom line and your reputation.
Robert E. Braun
Partner and Co-Chair of the Cybersecurity & Privacy Group
310.785.5331
RBraun@jmbm.com