Spoiler Alert: This Does Not Apply to you unless your business meets the threshold outlined below. Please review this carefully if you meet these criteria:
TIV Branding is very careful about protecting the interests of our website clients, and while very few of our clients are impacted by CCPA, we wanted to be sure to let everyone know the facts about the new privacy legislation.
There have been many questions about the new online information act in California that goes into effect on January 1, 2020. The California Consumer Privacy Act (CCPA) applies to companies that are located anywhere in the world that:
- Collect personal data of California residents
- They (or their parent company or a subsidiary) exceed at least one of the three thresholds:
- Annual gross revenues of at least $25 million
- Obtains personal information of at least 50,000 California residents, households, and /or devices per year
- At least 50% of their annual revenue is generated from selling California residents’ personal information
A California Resident is defined by the California laws as any person who:
- Is in California for other than a temporary or transitory purpose
- Has a permanent primary residence in California, but is currently outside the state for temporary or transitory purposes
For those businesses that are covered by the new law, it is required that:
Website and employee privacy policies are updated to include descriptions of the categories of information collected, third parties with whom data is shared, and rights available to individuals under CCPA.
Revise or create internal (non-customer-facing) privacy policies and procedures as well to ensure that employees are interacting properly with the public.
The CCPA contains data protection and security provisions and provides a private right of action for consumers affected by a data breach caused by a business’ failure to provide ‘reasonable security. Although the entire law takes effect on Jan. 1, 2020, only the security provisions will be immediately enforceable, either by the California Attorney General or via a private right of action.
Businesses that release personal information to the harm of the consumer may face litigation and/or government regulation penalties.
Businesses are responsible for knowing the types of personal information that you have collected in the past 12 months, the purposes for which you collected it, and the types of entities to whom you disclosed it in the past 12 months, and continue to track that on an ongoing basis.
Make sure that vendors give you the contractual protections you need for data restrictions. Review contracts to be sure that these protections are in place.
Train personnel to understand their privacy program so they can help reduce the risk for the business.
I am not an attorney, nor do I have an extensive knowledge of the new legislation, but if you feel that your business may be affected by the new CCPA regulations, I would strongly suggest that you seek the advice of qualified legal counsel to implement proper procedures and disclosures to comply with the new law that takes effect on January 1, 2020.
Eric Van Cleave is the Co-CEO and Digital Marketing Director for TIV Branding
TIV Branding is a boutique branding firm in Sonoma County, California. We specialize in building brands by using traditional, social and digital channels in unison. If you would like to discuss a project or find out more about how we do what we do, please email us at info@TIVbranding.com.