On January 1, 2020, the California Consumer Privacy Act (CCPA) went into effect, which establishes groundbreaking consumer privacy rights and protection of consumer and employee personal information.
Who must comply with the CCPA?
While the CCPA doesn’t apply to all employers, it could impact a number of CA businesses. Any for-profit business entity doing business in California that meets one of the following is subject to the CCPA: Gross revenue greater than $25 million; Annually buys, receives, sells or shares the personal information of more than 50,000 consumers, households or devices for commercial purposes; or Derives 50 percent or more of its annual revenues from selling consumers’ personal information. See attached article from CA Chamber for more information about the CCPA and which businesses must comply with the new law.
What will change in 2020 with the implementation of CCPA? What are potential action items?
The finalized content of the bill to be adopted is still evolving. As a result, requirements of the CCPA could change throughout the year. As of today, the requirements of the CCPA are as follows:
Companies must disclose to their California employees the type of personal information that is collected and maintained on their behalf and the purpose for collecting and maintaining it. Personal information is a broad concept and can include anything linked to an individual (e.g., SSN, name, address, bank information, geo-location, etc.) We recommend clients seek legal guidance to review their specific circumstances.
In addition to the information collected on behalf of the employee, the CCPA also requires any company with a website to disclose on their website the type of information they collect on web visitor data (e.g., cookies, IP address, etc.) and to provide a mechanism that enables users to request a copy of their collected information or request that information to be deleted.
This information may be legally privileged and/or is confidential, and is intended for the use of the addressee named above. Any other use is strictly prohibited. If you have received this communication in error, please immediately notify me and destroy the communication. Any wrongful interception of this transmission is prohibited and punishable under federal law.