Source: https://tomkemp.blog/2020/05/20/ccpa-cheat-sheet/
Timestamp: 2020-07-04 17:28:13
Document Index: 390758144

Matched Legal Cases: ['§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798', '§ 1798']

CCPA Cheat Sheet – Tom Kemp's Blog
In my last blog post I drilled down on the individual privacy rights that the California Consumer Privacy Act (CCPA) gives consumers, so for this blog I will provide a “CCPA Cheat Sheet” that not only recaps these rights, but also the scope, obligations and enforcement provisions found in the CCPA. This is very much akin to the “GDPR Cheat Sheet” I created in a prior blog post. In subsequent blogs I will put these together and give a summary of the similarities and differences between the two.
Category Topic CCPA Provision
5 Scope Covers Employees? No, not until January 1, 2021. [§ 1798.145(h)] Specifically, “the title shall not apply to … personal information that is collected by a business about a natural person in the course of the natural person acting as … an employee” and “this subdivision shall become inoperative on January 1, 2021.”
7 Scope Additional Restrictions on Sensitive Data? N/A
9 Scope Lawful Bases to Process Personal Data? No. The US Constitution’s 1st Amendment in general lets a business collect data that it wants to (see Sorrell v. IMS Health Inc.). But the CCPA requires that a business disclose what categories and the purpose for which they are collecting personal information (see Right to be Informed below), so as long as the consumer is informed and they don’t opt out (or opt-in in the case of minors), the business can collect. But note that Section 5(a) of the FTC Act provides that “unfair or deceptive acts or practices in or affecting commerce . . . are . . . declared unlawful.” 15 U.S.C. Sec. 45(a)(1).
10 Scope Law is Protected from Watering Down? N/A.
11 Individual Rights Right to be Informed (aka Right to Know or Right to be Notified) “A business that collects a consumer’s personal information shall, at or before the point of collection, inform consumers as to the categories of personal information to be collected and the purposes for which the categories of personal information shall be used. A business shall not collect additional categories of personal information or use personal information collected for additional purposes without providing the consumer with notice consistent with this section.” [§ 1798.100(b)] Furthermore, businesses must also inform consumers what rights the consumer has vis a vis the personal data, e.g. consumers need to be told they also have the right to request deletion of their personal data. [§ 1798.105(b)]
12 Individual Rights Right to Access “A consumer shall have the right to request that a business that collects a consumer’s personal information disclose to that consumer the categories and specific pieces of personal information the business has collected.” [§ 1798.100(a)] This includes any third-parties the business has shared the personal data with. And that the business shall provide that information once they verified the consumer request. [§ 1798.100(c)] Furthermore, a business shall “promptly take steps to disclose and deliver, free of charge to the consumer, the personal information.” But “a business may provide personal information to a consumer at any time, but shall not be required to provide personal information to a consumer more than twice in a 12-month period.” [§ 1798.100(d)]
13 Individual Rights Right to Correct (aka Right to Rectification) N/A
14 Individual Rights Right to Delete (aka Right to Erasure or Right to be Forgotten) “A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.” [§ 1798.105(a)] The business must also direct any service providers that the business utilizes to also delete the consumer’s personal information from their records. [§ 1798.105(c)] There are 9 exceptions in [§ 1798.105(d)] including performing the contractual obligations that exist between business and consumer, for security purposes, debugging, the exercise of free speech, and engage in research in the public interest.
15 Individual Rights Right to Restrict Processing N/A, with exception of the right to opt-out of the selling of personal information (see below).
16 Individual Rights Right to Data Portability Once a consumer requests access to their personal data from a business, and that request is verified, the “information shall be in a portable and, to the extent technically feasible, readily useable format that allows the consumer to transmit the information to another entity without hindrance.” [§ 1798.100(d)]
17 Individual Rights Right to Object to Processing N/A, with exception of the right to opt-out of the selling of personal information (see below).
18 Individual Rights Right to “Opt Out” of Sale and Sharing of Personal Information (aka Right to Say No) “A consumer shall have the right, at any time, to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt-out.” [§ 1798.120(a)]
19 Individual Rights Right to Limit Use of Sensitive Personal Information (including Precise Geolocation) N/A
20 Individual Rights Right to Reject Automated Decision Making and Profiling N/A
22 Obligations Privacy Policy Disclosure A business that collects a consumer’s personal information shall “disclose to that consumer the categories and specific pieces of personal information the business has collected.” This needs to be done “at or before the point of collection.” [§§ 1798.100(a)-(b)] A business must also disclose the consumer’s rights, e.g. “the consumer’s rights to request the deletion of the consumer’s personal information.” [§ 1798.105(a)] Privacy policies must be updated “at least once every 12 months.” [§ 1798.130(a)]
23 Obligations Data Protection by Design and Default N/A, with the exception that a business must identify what data is personal in the design of their systems and apps so as to provide proper notification.
24 Obligations Written Contracts with Processors / Service Providers / Contractors / Third Parties This is implied that a contract is in place with a service provider given the definition of “service provider” that is an entity that “processes information on behalf of a business and to which the business discloses a consumer’s personal information for a business purpose pursuant to a written contract, provided that the contract prohibits the entity receiving the information from retaining, using, or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract for the business.” [§ 1798.140(v)]
25 Obligations Maintain Records of Processing Activities Not really. The proposed CCPA regulations that are drafted as of March 2020 do assume there will be some documentation of consumer requests re: their personal information.
26 Obligations Respond to Rights Requests A business must respond to a “verifiable consumer request.” [§ 1798.140(y)]. The proposed CCPA regulations document how these requests should be logged. Furthermore, a business must “disclose and deliver the required information to a consumer free of charge within 45 days” and can extend the 45 days once. [§ 1798.130(a)] This information must be provided “free of charge to the consumer” but “shall not be required to provide personal information to a consumer more than twice in a 12-month period.” [§ 1798.100(c)] Businesses must also respond to other rights requests (e.g. deletions, do not sell, etc.) with no limitations. [§ 1798.105(c), 1798.120(d)]
27 Obligations New Homepage Links Required (e.g. do not sell/share personal information, limit use of sensitive personal information) A business must “provide a clear and conspicuous link on the business’s Internet homepage, titled “Do Not Sell My Personal Information,” to an Internet Web page that enables a consumer, or a person authorized by the consumer, to opt-out of the sale of the consumer’s personal information. A business shall not require a consumer to create an account in order to direct the business not to sell the consumer’s personal information.” [§ 1798.135(a)]
28 Obligations Implement Appropriate Security Measures Not a direct obligation found in the CCPA. Per the private right of action section [§ 1798.150(a)] it states that “any consumer whose nonencrypted and nonredacted personal information … is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action.” Furthermore, existing California law states that “a business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.” [§ 1798.81.5]
29 Obligations Security Breach Notification N/A, but California has an existing (and separate) data breach notification law § 1798.82.
30 Obligations Data Protection Impact Analysis N/A
31 Obligations Data Protection Officers N/A
32 Obligations Adhere to the Rules of Cross-Border Data Transfers N/A
33 Enforcement Dedicated Supervisory Authority The CCPA did not create a dedicated agency to enforce the CCPA. The California Attorney General (AG) is tasked with adopting regulations re: the CCPA based on public participation. [§ 1798.185] “Any business or third party may seek the opinion of the AG for guidance on how to comply with the provisions of this title.” [§ 1798.185] The AG can issue civil fines (see below). Any proceeds from civil actions will go into the Consumer Privacy Fund. This Fund is “created within the General Fund in the State Treasury, and is available upon appropriation by the Legislature to offset any costs incurred by the state courts in connection with actions brought to enforce this title and any costs incurred by the Attorney General in carrying out the Attorney General’s duties.” [§ 1798.160] The AG “shall not bring an enforcement action under this title until six months after the publication of the final regulations issued pursuant to this section or July 1, 2020, whichever is sooner.” [§ 1798.185]
34 Enforcement Penalties (Civil Fines) “A business shall be in violation … if it fails to cure any alleged violation within 30 days after being notified of alleged noncompliance. Any business, service provider, or other person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General.” [§ 1798.155 (b)]
35 Enforcement Penalties (Private Rights of Action) CCPA enables a consumer’s private right of action only in the narrow context of their “nonencrypted and nonredacted personal information” was “subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices.” Damages may be “not less than $100 and not greater than $750 per consumer per incident or actual damages, whichever is greater.” [§ 1798.150(a)] There is not another right of action beyond a breach occurring (e.g. no private right of action if a business is not deleting their information upon request). Furthermore, the definition of “personal information” is from a narrower definition of personal information found in [§ 1798.81.5]. Note that “actions pursuant to this section may be brought by a consumer if, prior to initiating any action against a business for statutory damages on an individual or class-wide basis, a consumer provides a business 30 days’ written notice identifying the specific provisions of this title the consumer alleges have been or are being violated. In the event a cure is possible, if within the 30 days the business actually cures the noticed violation and provides the consumer an express written statement that the violations have been cured and that no further violations shall occur, no action for individual statutory damages or class-wide statutory damages may be initiated against the business.” [§ 1798.150(b)]
Here are some other executive summaries of CCPA from some law firms that compare CCPA to GDPR that you also may find helpful:
Previous “Know Your Rights” under the CCPA
Next High-Level Comparison of GDPR and CCPA
[…] in the context of other US privacy laws, and provided a detail “cheat sheet” for both GDPR and CCPA, lets compare the two at a high level from a scope, individual rights, obligations and enforcement […]
[…] so given that I created a GDPR Cheat Sheet and a CCPA Cheat Sheet, let’s combine them together and get a Detail Comparison of the world’s foremost […]
[…] covering in detail the EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), another major piece of data protection and privacy legislation looms large. It is very […]
[…] on the EU’s General Data Protection Regulation (GDPR) and on the California Consumer Privacy Act (CCPA), and then compared the two at both a high and detail level. I am now looking at “Version […]
[…] Next up will be a cheat sheet for the CPRA ala my cheat sheets for GDPR and CCPA. […]
[…] laws. If you want more context behind a given cell, then check out the cheat sheets for GDPR, CCPA and […]
[…] CPRA represents “Version 2.0” of the California Consumer Privacy Act (CCPA). As a reminder the CCPA is the United States’ most comprehensive consumer privacy law that […]