Articles Posted in California Law

by

As most (but not all) business know, the California Consumer Privacy Act of 2018 (the “Act” or “CCPA”) goes into effect January 1, 2020. It is estimated that more than 500,000 companies are subject to the CCPA, many of them smaller and mid-size businesses that may not have pre-existing robust privacy policies and procedures.

The CCPA applies to for-profit entities that both collect and process the personal information (as defined in the Act) of California residents and do business in the State of California, whether or not the business has a physical presence in California. Businesses that meet at least one of the following criteria are subject to the Act:

  • Generate annual gross revenue in excess of $25 million,
  • Receive or share personal information of more than 50,000 California residents annually, or
  • Derive at least 50 percent of its annual revenue by selling the personal information of California residents.

While enforcement actions by the Attorney General won’t begin until six months after the final regulations are published, or July 1, 2020, companies need to ensure they are in compliance on January 1, 2020, when the Act goes into effect. This article is a summary of a five-part series designed to guide companies through compliance, “Complying with the California Consumer Privacy Act in 5 (More or Less) Not So Easy Steps.”

Part 1 – Data Mapping

A company cannot comply with the Act without understanding what data the company collects, how it uses the data and who has access to it. Understanding how the company collects, processes, transmits and stores data – as well as how it’s used and who uses it – is the foundation of a data privacy program and the key to complying with the Act and most other privacy regulations. A company’s data is often its most valuable asset, but the exact movements of sensitive data are often poorly understood, providing unknown exposure points and increasing the risk of data loss.

There is a benefit to this practice that goes beyond complying with the Act. Companies can determine the extent of their data collection practices and whether it advances the business. Companies must realize that every point of data it holds is not just an asset, but also a liability. Eliminating unnecessary data reduces liability exposure. Understanding a company’s data profile leads to efficiencies in operations and can better rationalize costs associated with maintaining data, including cybersecurity and insurance expenses. Learn more here.

Continue reading

by

Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps

Part 5 of a Series

Consumer Rights: Deletion, Do Not Sell, Non-Discrimination

The California Consumer Privacy Act obligates covered businesses to disclose the categories of personal information, the sources of personal information and uses of personal information collected in the course of their operations.  In addition, the CCPA gives consumers specific rights not just to know what data is being collected, but also whether and how that data can be used.  Compliance with the CCPA requires an understanding of these rights, and adoption of procedures to comply with them.

Deletion

Under Section 1798.105 of the CCPA, consumers have the right to request a business to delete “any personal information about the consumer which the business has collected from the consumer.” The business must fulfill such requests — and to direct “any service providers,” as that term is defined in the CCPA, to do the same — within 45 days of receiving a “verified request” or “verifiable request” from the consumer.  Businesses should be aware that the consumer’s right to delete is one of the provisions that must be included in the company’s privacy policy.

The right to delete is not absolute.  Businesses are also not required to delete information “if it is necessary” to:

  • Complete the transaction for which it was collected.
  • Provide a good or service the consumer has requested.
  • Perform a contract between the business and the consumer.
  • Detect security incidents.
  • Protect against “malicious, deceptive, fraudulent, or illegal” activities.
  • Prosecute people responsible for “malicious, deceptive, fraudulent, or illegal” activities.
  • “Debug to identify and repair errors that impair existing intended functionality.”
  • Ensure the exercise of free speech by another customer.
  • Ensure the company’s exercise of “another right provided for by law.”
  • Comply with a legal obligation, in particular, those of the California Electronic Communications Privacy Act.

These exceptions give businesses a broad range of reasons to keep information.  For example, a business may continue to use a consumer’s personal information that has been the subject of a deletion request “internally, in a lawful manner that is compatible with the context in which the consumer provided the information.” A similar exception is carved out for “solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.”

Opt-out of Sales

The CCPA gives consumers two related rights regarding the sale of personal information: 1) a “right to opt out” of the sale of personal information, and 2) for consumers under the age of 16, a “right to opt in”. Continue reading

by

Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps:
Part 4 of a Series

Verified Requests for Data

The CCPA is hurtling headlong toward implementation on January 1, 2020.  The Act, which is likely to be amended, perhaps substantially, in the next sixty days, and which has no guiding regulations, continues to present a conundrum for companies faced with designing and implementing policies and procedures that need to be consumer-ready by Day 1.

One requirement that has created substantial confusion and uncertainty is directly related to a key element of the Act – the right of consumers to control the personal information held by companies. Under the Act, companies must develop or identify internal mechanisms to respond to a consumer’s exercise of their right to access the information collected about them, verify their identity, respond within the mandated 45 days, and document both the request and response.

While the obligation is clear and seemingly innocuous, it is creating both confusion and its own cottage industry of consultants and service providers.

The sticking point of this requirement is determining how a company will reasonably verify the requester’s identity. The California Attorney General was to have adopted regulations to help businesses determine when a request is a verified consumer request (sometimes referred to by the quaintly anachronistic acronym “VCR”). Those regulations have not yet been proposed.

In the interim, companies are left with little more than what feels like the type of direction from U.S. Supreme Court Justice Potter Stewart, when he was forced to define a threshold test for obscenity in 1964:

“I shall not today attempt further to define the kinds of material I understand to be embraced within that shorthand description, and perhaps I could never succeed in intelligibly doing so. But I know it when I see it….”

Like so much of the CCPA, the obligation is appropriate on its face, but difficult to implement. Continue reading

by

Ever since the California Consumer Privacy Act (the “CCPA”) was adopted in 2018, various constituencies have lobbied for revisions. While multiple proposals were considered in the California legislature, only a few have a chance for passage and enactment. Last month, the California Senate Judiciary Committee passed several amendments to the CCPA, and we now have a better idea as to what amendments are likely to be adopted. The bills head now to the Appropriations Committee and then to the full state Senate. Here are the important highlights:

  • Employee Exemption: With AB25, lawmakers weakened the employee exception, which now sunsets on Jan. 1, 2021. The current exemption means CCPA does not cover collection of personal information from job applicants, employees and certain others, but only for one year. Afterward, employers will be required to tell employees what type of information they are collecting, and why.
  • Loyalty Programs: AB 846 clarifies and modifies CCPA application to loyalty and reward programs. Businesses would still be prohibited from selling consumer information gathered as part of these programs.
  • Phone Access: AB 1564 requires businesses to provide a toll-free phone number for customers to request access to their personal information. On-line only businesses are only required to provide an email address.

Three bills, AB 873, AB 1416 and AB 981 failed. They would have changed the definition of “personal information” and “de-identified information,” weakening the privacy protections.

These and several related bills will head to the full Senate, which must vote by Sept. 13, 2019. Governor Newsom then has a month to consider signing them (along with another 1,000 or so bills), and any bill that is signed will go into effect Jan. 1, 2020.

Bottom Line: The law’s strong consumer protections withstood challenges, though observers anticipate there will continue to be debate and negotiations with unions as to how CCPA affects employees. Companies should continue apace with their plans for implementation.  Companies that haven’t yet begun to comply should start now!

See our recent blogs on the CCPA below.

Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps:

 Part 1 – the Data Map
 Part 2 – the Breach Response Plan
 Part 3 – the Privacy Policy

—

Robert E. Braun is the co-chair of the Cybersecurity and Privacy Law Group at Jeffer Mangels Butler & Mitchell LLP. Bob helps clients to develop and implement privacy and information security policies, negotiate agreements for technologies and data management services, and comply with legal and regulatory requirements. He helps clients to develop and implement data breach response plans, and he and his team respond quickly to clients’ needs when a data breach occurs. Contact Bob at RBraun@jmbm.com or +1 310.785.5331.

JMBM’s Cybersecurity and Privacy Group counsels clients in a wide variety of industries, including accounting firms, law firms, business management firms and family offices, in matters ranging from development of cybersecurity strategies, creation of data security and privacy policies, responding to data breaches and regulatory inquiries and investigations, and crisis management. The Cybersecurity and Privacy Group uses a focused intake methodology that permits clients to get a reliable sense of their cybersecurity readiness and to determine optimal, client-specific approaches to cybersecurity.

by

Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps 
Part 3 of a Series

 The Privacy Policy

This is the third in a series of articles on complying with the California Consumer Privacy Act (CCPA). The CCPA is estimated to directly impact more than 500,000 businesses, many of them smaller and mid-size businesses; even more companies that are not specifically subject to the CCPA will need to comply to do business with those that are.

The CCPA says that California residents, including minors, have the right to know if their personal data is being collected, and to whom the data is being sold, and with whom it is being shared. Armed with that knowledge, California residents have the further right to object to the sale of their data and to have their data deleted. In short, California consumers now own their personal information and have real control over it. It is important to note that personal data includes almost any data that can identify an individual, not just financial data.

Complying with the detailed requirements of the CCPA — including disclosure and notice procedures, opt-out rights, updating privacy policies, and revising vendor agreements — is daunting. In our first article, we highlighted the importance of the data map. In our second article, we covered breach response.

In this post, we’ll review the changes companies need to be making to their privacy policies in order to comply with the CCPA. The Act mandates that any company subject to the CCPA make specific public disclosures, including: Continue reading

by

Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps
Part 2 of a Series

What’s Next – the Breach Response Plan

This is the second in a series of articles on complying with the California Consumer Privacy Act (CCPA). The CCPA is estimated to impact more than 500,000 businesses, many of them smaller and mid-size businesses., Complying with the detailed requirements of the CCPA — including disclosure and notice procedures, opt-out rights, updating privacy policies, and revising vendor agreements – is daunting.  In our last article, we highlighted the importance of the Data Map. When you finish your data map, what should you do next?

What is the CCPA?

The California Consumer Privacy Act was signed into law on June 28, 2018, and will become effective January 1, 2020 – although the Attorney General is precluded from bringing an enforcement action under the CCPA until the earlier of six months after the final regulations are published, or July 1, 2020.  The effective date of the Act gives covered businesses little time to prepare.  Preparing now is particularly important, because many obligations under the Act will require advance work, and companies will need to begin now.

After the Data Map – the Incident Response Plan

Most businesses understand that if they suffer a data breach – if specified personal information is accessed by unauthorized users – the business has to consider notifying the individuals whose information has been accessed, and possibly their regulators. Despite the fact that laws requiring notification laws have been in effect for more than 15 years, many companies do not have plans to address a breach. Commencing on January 1, 2020, when the CCPA goes into effect, the inability to respond will become a bigger issue. The reason – the CCPA grants a private right of action to individuals.

Actions under the CCPA

Under the CCPA any natural person who is a resident of California may bring an action if their unencrypted or unredacted personal information has been exposed due to a business’s failure to maintain appropriate security safeguards. The definition of personal information under the CCPA is broader for most purposes of the Act than when determining a breach – it is limited to a person’s name (at least first initial and last name) and either their social security number, driver’s license or state identification number, bank or credit card information, or medical or health insurance information.

There is no requirement that a plaintiff demonstrate damages; instead,` plaintiffs can seek statutory damages between $100 and $750, injunctive or declaratory relief, or “any other relief the court deems proper. In addition, plaintiffs can seek actual damages in excess of the statutory recoveries. And the Act specifically allows the aggregation of claims into a class action. The specific authorization of a private right of action means that any breach is more likely to result in extended, costly, and embarrassing legal action. Continue reading

by

Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps
Part 1 of a Series

First Steps First – the Data Map

It is estimated that more than 500,000 companies are subject to the California Consumer Privacy Act (CCPA), many of them smaller and mid-size business, where the detailed requirements of the Act – disclosure and notice  procedures, opt-out rights, updating privacy policies, and revising vendor agreements – is daunting.  So where should a business begin in its efforts to meet the Act’s requirements?

What is the CCPA?

The California Consumer Privacy Act was signed into law on June 28, 2018, and will become effective January 1, 2020 – although the Attorney General is precluded from bringing an enforcement action under the CCPA until the earlier of six months after the final regulations are published, or July 1, 2020.  The effective date of the Act gives covered businesses little time to prepare.  Preparing now is particularly important, because many obligations under the Act will require advance work, and companies will need to begin now.

What businesses must comply with the Act?

As has been well publicized, the Act is applicable to many businesses, whether located inside or outside California.  The Act applies to for-profit entities that both collect and process the personal information (as defined in the Act) of California residents and do business in the State of California –  a physical presence in California is not a requirement to becoming subject to the Act. Additionally, the business must meet at least one of the following criteria:

  • Generate annual gross revenue in excess of $25 million,
  • Receive or share personal information of more than 50,000 California residents annually, or
  • Derive at least 50 percent of its annual revenue by selling the personal information of California residents.

What to do first – Data mapping

The first, and possibly most important, thing a company should do to comply with the Act is to understand what data the company collects, how it uses the data and who has access to it.  Understanding how the company collects, processes, transmits and stores data – as well as how it’s used and who uses it – is the foundation of a data privacy program and the key to complying with the Act and most other privacy regulations.  A company’s data is often its most valuable asset, but the exact movements of sensitive data are often poorly understood, providing unknown exposure points and increasing the risk of data loss.  Continue reading

by

JMBM’s Cybersecurity & Privacy Group is pleased to announce that the Group’s Co-Chair, Michael A. Gold, will be participating as a panelist for the webinar Bristows Legally Speaking! Data protection and information security in EU, India and California – what next?

Sponsored by the London-based law firm Bristows, the webinar is open to C-suite executives, Chief IT officers, in-house counsel, and others whose companies are doing business in California, Britain, the EU, or India.

Date: Tuesday, October 30, 2018
Time: 9:00 AM – 10:00 AM Pacific

No registration fee is required. Register here.

Panelists include:

Robert Bond, Partner and Notary Public at Bristows LLP, London
Salman Waris, Partner at TechLegis Advocates & Solicitors, Delhi
Michael Gold, Partner at Jeffer Mangels Butler & Mitchell LLP, Los Angeles

Topics that will be explored include:

  • Draft data protection law in India
  • California data privacy laws explained
  • Overview of US privacy laws
  • Comparisons with EU laws
  • What else is on the global horizon for data protection?

We invite you to join us for this informative webinar. Register now!

by and

iheartcalifornia-300x138On June 28, 2018, Governor Brown signed the California Consumer Privacy Act of 2018, which goes into effect on January 1, 2020. But – because of certain look-back features in the new law – significant compliance will be required by January 1, 2019.

The Act is enforceable by the California Attorney General and authorizes a civil penalty up to $7,500 per violation.

Observers estimate that about 500,000 companies nationwide will need to comply with the California Consumer Privacy Act. The California Attorney General is expected to aggressively enforce the Act – and it will have the budget to do so. Consumer watchdogs and plaintiffs class-action lawyers will also be on the hunt for violators.

__________________________

This is a serious law and violations will have serious repercussions for your bottom line and your reputation.

__________________________

The Act provides many of the same consumer privacy protections as the European Union’s General Data Protection Act (GDPR). JMBM’s Cybersecurity & Privacy Group has counseled dozens of companies on GDPR compliance and is now discussing California’s new law with clients; we are eager to help you assess your own compliance and protect your business from expensive liability and litigation.

Some key points:

What does the Act do?

The new act says that California residents, including minors, who give personal data of almost any kind to a for-profit business, have the right to know how the data is being used, have it deleted, know who the data is being sold to, and object to the sale of their data. In short, California consumers now own their personal information and have a significant measure of control over it. It is important to note that personal data includes almost any data that can identify an individual, not just financial data.

Who is subject to the Act?

The California Consumer Privacy Act applies to any for-profit business that:

  • Does business in the state of California;
  • Collects consumers’ personal information (or is the entity on whose behalf such information is collected) and determines how that information is collected and processed;
  • Meets one or more of the following thresholds: has annual gross revenues in excess of $25 million; buys, receives, sells, or shares the personal information of 50,000 or more consumers, households or devices; or, derives 50% or more of its annual revenue from selling consumers’ personal information. The Act applies to small and mid-sized businesses, not just large companies.

What happens if a company does not comply?

The act is enforceable by the California Attorney General and authorizes a civil penalty up to $7,500 per violation.

In the event of a data breach, California residents will have a private right of action to recover up to $750 per incident, or actual damages. The statute directs courts to consider the nature, seriousness, persistence and willfulness of an incident, the number of violations, the length of time over which the incident occurred, and the violating company’s assets, liabilities and net worth.

Because of the minimum recoverable amount, consumers do not have to prove actual damages, only that there was a violation of the act.

What do you need to do now?  

California businesses will need to take several steps to achieve compliance, including:

  1. Adopt a method for handling consumer requests for personal information.
  2. Develop templates and procedures for responding to consumer requests.
  3. Develop procedures for collecting and processing data.
  4. Identify and document the legal basis for collecting and processing personal information, in order to respond to the consumer’s right to have their information deleted.
  5. Make appropriate changes to public-facing website disclosures, including adding a description of consumers’ rights under the Act, listing the categories of data collected, and including a conspicuous way for consumers to indicate that they do not want their data sold.

 What should you do now?

Contact us to discuss whether this new act applies to you, and how you should prepare for it. This is a serious law and violations will have serious repercussions for your bottom line and your reputation.

 

Gold_Michael_Highres_03
Michael Gold
Partner and Co-Chair of the Cybersecurity & Privacy Group
310.201.3529
MGold@jmbm.com
Bob Braun Photo
Robert E. Braun
Partner and Co-Chair of the Cybersecurity & Privacy Group
310.785.5331
RBraun@jmbm.com

 

by

It didn’t take long.

On June 28, 2018, just more than a month after the EU’s General Data Protection Regulation went into effect, imposing broad obligations and restrictions on any entity collecting personal information of EU citizens and residents, the California legislature has passed AB 375, and the governor has signed, the California Consumer Privacy Act of 2018, providing many of the same protections and sure to upend privacy regulation in the United States.

The Act goes into effect on January 1, 2020, and while it has broad implications that will become more apparent over time, there are some key initial takeaways:

  • The Act applies to all personal information, which is broadly defined, not just information collected electronically or collected directly by a firm. Companies will need to consider all of their data acquisition functions, and conform their practices to the Act.
  • The Act defines “personal information” as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Significantly, personal information explicitly includes a real name, alias, postal address, unique personal identifier, online identifier Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.  And, particularly significant in light of this week’s Supreme Court decision, it includes geolocation data.  This is a far-reaching extension of how personal information has been defined in the United States for privacy purposes.
  • The Act would grant a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of third parties with which the information is shared.
  • The Act includes a private right of action, allowing consumers to seek damages for certain categories of unauthorized disclosures.
  • Business will be required to make disclosures about the information and the purposes for which it is used.
  • Consumers will have the right to request deletion of personal information and would require the business to delete upon receipt of a verified request.
  • Consumers will have the right to opt out of the sale of personal information by a business, and businesses will be prohibited from discriminating against the consumer for exercising this right, including by charging the consumer who opts out a different price or providing the consumer a different quality of goods or services, except if the difference is reasonably related to value provided by the consumer’s data.
  • The Act will protect California citizens, and apply to any company that has annual gross revenues in excess of $25,000,000, alone or in combination, or annually buys, receives for the business’ commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices, or derives 50 percent or more of its annual revenues from selling consumers’ personal information. You should note that these tests are in the alternative, and that it will include many smaller companies.

These are only a few of the provisions of the Act, but it is clear that it has the potential of impacting companies throughout the nation.  Just as California’s initial breach notification act, adopted in 2002, radically changed the privacy landscape, the California Consumer Privacy Act of 2018 is likely to have as important an impact.

The authors of the Act recognize that it will require additional clarifying regulation to implement, and the Act itself authorizes the Attorney General to issue opinions on the scope of the Act.

While the ink on the Act is still wet, it seems clear that the Act reflects many of the requirements of the EU’s General Data Protection Regulation, and complying with the GDPR will put companies at a competitive advantage against those who wait.

The JMBM Cybersecurity and Privacy Group has worked with dozens of companies to establish procedures and policies to achieve GDPR compliance.  For additional information, contact Bob Braun (rbraun@jbmb.com, 310.785.5331) or Mike Gold (mgold@jmbm.com, 310.201.3529).

 

Robert E. Braun is the co-chair of the Cybersecurity and Privacy Law Group at Jeffer Mangels Butler & Mitchell LLP. Bob helps clients to develop and implement privacy and information security policies, negotiate agreements for technologies and data management services, and comply with legal and regulatory requirements. He helps clients to develop and implement data breach response plans, and he and his team respond quickly to clients’ needs when a data breach occurs. Contact Bob at RBraun@jmbm.com or +1 310.785.5331.

JMBM’s Cybersecurity and Privacy Group counsels clients in a wide variety of industries, including accounting firms, law firms, business management firms and family offices, in matters ranging from development of cybersecurity strategies, creation of data security and privacy policies, responding to data breaches and regulatory inquiries and investigations, and crisis management. The Cybersecurity and Privacy Group uses a focused intake methodology that permits clients to get a reliable sense of their cybersecurity readiness and to determine optimal, client-specific approaches to cybersecurity.