California’s CCPA act went into effect on January 1, but you have until July 1, 2020 when it is enforced. Get started now. First, you need to
Add a footer to all of your web pages to the effect of “The CCPA requires us to notify you that we could sell your data unless you opt-out here” and provide them a link. Do it even if you don’t sell data.
CCPA applies to you if:
- At least half of your organization’s revenue is from the sale of personal data, or
- Your organization stores personal data of fifty thousand people or more, or
- Your organization has at least twenty-five million dollars annual revenue
If one of those applies, then:
- If a consumer in California asks, you must be able to give them copies of all of the data you collected about them.
- You must be able to tell them if you sold their data and to whom.
- Consumers can demand that you delete their data. Scouring their information from all of your applications and tools can be difficult because you have to remove them from your contact list, accounts receivable, order history, and everywhere else you store any information about them or their activities.
Protected data includes contact information and anything that can identify a household, including GPS locations.
Confusion abounds in the CCPA. For example, if consumers choose to opt-out, an organization cannot discriminate against them by blocking or offering a lower level of service. But some companies provide services based on their consumers’ data, so how can they give the same level of service to consumers who do not provide data? Another example is that employers need to keep some data on employees. What if an employee asks to have all their data, including their social security number, erased everywhere, but want to continue their employment? There are extensive attempts to address these issues, but the rules are confusing.
You’ll need to involve your lawyer to help wade through the issues, and that leads to the obligatory disclaimer: Do not misconstrue this to be legal advice. Check with your lawyer.
The CCPA is only the beginning. Expect to see similar laws in other states and at a national level too. Please forward this to your friends and associates, so they know they only have until July 1, 2020, to prepare.