The recently enacted California Consumer Privacy Act (“CCPA” or the “Act”) goes into effect on January 1, 2020 and with it comes enhanced consumer protections for California residents against businesses that collect their personal information. Generally speaking, the CCPA requires that businesses provide consumers with information relating to the business’ access to and sharing of personal information. Accordingly, businesses should determine whether the CCPA will apply to them and, if so, what policies and procedures they should implement to comply with this new law.
Application of the CCPA
Importantly, the CCPA does not apply to all California business. The requirements of the CCPA only apply where a for-profit entity collects Consumers’ Personal Information, does business in the State of California, and satisfies one or more of the following: (1) has annual gross revenues in excess of twenty-five million dollars ($25,000,000); (2) receives for the business’s commercial purposes, sells, or shares for commercial purposes the personal information of 50,000 or more consumers, households, or devices; or (3) derives 50 percent or more of its annual revenues from selling consumers’ personal information. (California Code of Civil Procedure § 1798.140(c)(1)(A)-(C).) Thus, as a practical matter, small “mom and pop” operations will likely not be subject to the CCPA, but most mid-size and large companies should review their own books or consult with an accountant to determine whether the CCPA applies to their business.
Rights Granted to Consumers
“Consumers,” as the term is used in the CCPA, means “any natural person who is a California resident…” (California Code of Civil Procedure § 1798.140(g).) This broad definition makes no carve-outs or exclusions for a business’s employees and, despite the traditional definition of the term “consumer,” does not seem to require that the resident purchase any goods or services. This definition seems intentional and was likely designed to prevent businesses from attempting to circumvent the requirements of the CCPA by arguing that the personal information they collect does not belong to “consumers” under the traditional meaning of the word.