A quick reference guide for CCPA compliance

The CCPA will apply to for-profit businesses that collect and control California residents' personal information, do business in the state of California, and meet at least one of the following thresholds:

● Annual gross revenues larger than $25 million
● Receive or disclose the personal information of 50,000 or more California residents, households, or devices each year
● Make 50 percent or greater annual revenue from selling California residents' personal information

Non-profits, smaller companies that don't meet the revenue thresholds, and/or those that don't traffic in large amounts of personal information from California residents, and don't share a brand with an affiliate that's covered by the CCPA won't have to comply.

Currently, the CCPA extends to for-profit companies established in California (i.e., doing business in California) and entities that “indirectly” qualify as doing business (i.e., parents and subsidiaries of companies established in California).

Organizations located outside of California may wonder if they’re subject to the CCPA. If a business transacts with California residents and meets threshold requirements, it’s also important to consider whether that business collects the personal information of California residents. The scope of the CCPA is secured to the residency of the consumer—its purpose is to protect the rights of residents in California.

The CCPA will be enforced on January 1, 2020. Upon taking effect, consumers will be able to request that a business disclose specific pieces of information for the preceding 12 months—from as early as January 1, 2019—that a business has collected or processed about the consumer and whether such information was disclosed or sold to a third party.

Additionally, the California attorney general (AG) will delay its own enforcement actions for a period of six months after the act goes into enforcement. It’s important to note that consumers can still lodge a complaint directly with a business or can request their personal information from a business beginning on January 1, 2020.

The CCPA will mean that increased disclosures become a large part of compliance for businesses subject to the new law. Organizations should prepare comprehensive privacy notices that are presented to consumers when personal information is collected. These notices should include descriptions as to how personal information is collected, how that personal information is used, and the categories of personal information the business has sold to third parties in the last year.

Businesses also need to publicly disclose and inform consumers of the existence and nature of consumers’ rights under the CCPA. These rights include the ability for an individual to request the business to provide copies of their personal information.

The CCPA has defined personal information more broadly than typical privacy-related laws in the United States. Personal information is defined under the CCPA as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” The definition is broader (and more complex) than the GDPR.

The definition of personal information also lists a wide range of standard examples that includes Social Security numbers, drivers’ license numbers, purchase histories, and “unique personal identifiers” like device identifiers and online tracking technologies.

The CCPA excludes information that’s publicly available, such as property tax data from the government records or otherwise publicly maintained.

The CCPA also excludes aggregated data, as well as medical or health information collected by a person or entity governed by California’s Confidentiality of Medical Information Act or Health Insurance Portability and Accountability Act of 1996 (HIPAA).