The California Consumer Privacy Act, which will go into effect January 1, 2020, sets out to put greater restrictions around how companies can collect and use data. This law is interesting as it may have the potential to change the privacy law landscape in the United States.
In January, the law will provide consumers with four basic rights in relation to their personal information (Personal information is defined as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” The law provides a non-exhaustive list of examples.). First, the law will grant consumers the right to know what personal information a business has collected about them, what it is being used for, whether it is being sold/disclosed, and to whom it is being sold/disclosed. The law will require that companies proactively disclose how their consumers’ personal information will be collected/handled through their privacy policies. Additionally, it will also give consumers the right to “opt out” of allowing a business to sell their personal information to third parties. This will require that businesses provide a “clear and conspicuous” link titled “Do Not Sell My Personal Information” on the business’s home page. Lastly, the California Consumer Privacy Act will provide consumers the right to have a business delete their personal information from the business’s data and the right to receive equal service and pricing from a business, even if they exercise their privacy rights under the law.
It is important to note that not all businesses will be affected by this law. The California Consumer Privacy Act is intended to target for-profit businesses that do business in the State of California, and either have annual gross revenues that exceed $25 million, receive personal information of 50,000 consumers or more, or derive 50 percent or more of their annual revues from selling personal information. If a qualifying business does violate a consumer’s rights, it will be subject to penalties. The civil penalty is up to $7,500 per violation and a thirty-day cure period.
This new law may impact the nation as a whole—not just California. This is because it sets out to protect California consumers which means companies which are based outside California may be subject to this law if they have California consumers using their product. This could be difficult for businesses as they may have to change their online services in fear of having to make different versions of their websites. Additionally, since California has adopted some privacy protections in the past, this could cause discrepancy between these already-existing laws.