California Consumer Privacy Act of 2018 (“CCPA”) goes into effect on January 1, 2020. CCPA will apply to business that (a) operate for profit; (b) collect consumer (natural person and a California resident) personal information or determine the purposes and means by which consumer personal information is processed; c) conduct business in California; and (d) meet one of more of the following criteria: (i) Have annual gross revenues in excess of $25 million; (ii) Buy, receive for their commercial purposes, sell or share for commercial purposes the personal information of 50,000 or more consumers, households, or devices annually; or (iii) Derive 50% or more of their annual revenues from selling consumer personal information. Personal information is defined to mean “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”
Consumers will receive the following rights:
to request that businesses that seek to collect personal information about them inform them about the categories of personal information to be collected and the purposes for which it will be used;
to access personal information about themselves collected by a business by making a request to the business for that information;
to request that a business delete any personal information it has collected about the consumer (except under circumstances where the business is required to retain the data); and
to opt-out of having their personal information sold to third parties.
The CCPA contains the directive to the California Attorney General to adopt regulations to further its purposes, which will, hopefully, clarify its vagueness and over-broad scope.