Privy to Privacy: Your Business and the CCPA

With each passing year, the bar set for data protection policies keeps on rising. Incessant cyber-attacks have put every state authority in a tight spot, with consumers demanding more protective laws and stringent legal action against data breaches. In the wake of the 2018 Facebook data breach, California authored the California Consumer Privacy Act (CCPA), mandating compliance for any business that deals with residents from California.

The CCPA, which went into effect in January 2020, strengthens privacy protection rights for Californians in many ways, including:

• The option to have their data deleted.
• Knowledge of all personal data that has been collected by businesses.
• Ability to opt out of having their data collected or sold.
  
  

Who must comply with CCPA?

Any business that deals with California residents and falls under the following three criteria need to comply with the CCPA:

• Gross annual revenues of $25 million or more.
• Businesses that purchase, receive, or sell personal data from 50,000 or more individuals, households, or devices.
• Sales of personal data represent 50% or more of annual revenues.
  
  

Additionally, businesses that handle personal data from more than 4 million consumers must fulfil additional obligations.

Who can be exempted?

This act may provide exemption to certain health and financial organizations that already come under the federal data security laws, including:

• Companies already complying with HIPAA
• Banks and Financial institutes covered by the Gramm-Leach-Bliley Act
• Credit reporting agencies that fall under the Fair Credit Reporting Act
  
  

What is the cost of non-compliance?

The Attorney General can levy fines ranging from $2,500 for non-intentional violations to $7,500 for intentional violations. Additional penalties of hundreds of dollars for each impacted consumer could also be added to the total cost of the fine.

The intricacies of the CCPA can be confusing, but Citrin Cooperman’s team of professionals understands the fine points of the act and can help you navigate, implement, and maintain your compliance efforts.