The California Consumer Privacy Act of 2018 becomes effective January 1, 2020. The Act adds 22 sections to the Civil Code and amends a 23rd section. If you are in business, it might affect you. With a January effective date, you don’t have much time left to meet its requirements.
Application: The Act applies to “businesses.” A “business” is any individual or for-profit entity that does business in California and collects or uses consumers’ personal information, and which:
- Has annual gross revenues in excess of $25,000,000; or
- Buys sells or uses the personal information of 50,000 or more consumers, households or devices; or
- Derives 50% or more of its revenue from selling consumers’ personal information.
If you or your business does not satisfy any of these criteria, the Act does not apply to you. (It’s the sole advantage of having revenue that doesn’t exceed $25,000,000.) You cannot avoid its terms by breaking up your business into smaller entities.
Enforcement: The Act has teeth. If you fail to maintain “reasonable security procedures” you may be liable for damages of $100.00 to $700.00 per incident, or actual damages, whichever is greater. You may also be faced with an injunction and “any other relief the court deems proper.” Any consumer whose personal information is stolen may sue you for these damages.
The attorney general may also sue you for a civil penalty. The limit is $2,500 for each violation, unless the violation is intentional. Then the limit is $7,500 per violation. These penalties are used to support enforcement of the Act. This gives the attorney general an incentive for aggressive enforcement.
Effective January 1, 2020: You will be required to keep and to disclose to consumers the various categories and specific pieces of personal information that you collect. You must give consumers the right to opt-out of the sale of personal information. You may not discriminate against consumers who opt-out, or give discounts to those who permit their information to be sold.
On your internet home page, you must post a “conspicuous link” to a page that permits consumers to opt-out. (Instead, you may use an alternative homepage dedicated to California consumers.)
Effective Later: Certain definitions and obligations will be based on regulations to be adopted by the attorney general. Those regulations will be effective six months after the AG publishes them. The AG must adopt them by July 1, 2020, but may act sooner.
Conclusion: This is an accurate, but imprecise, summary of the Act. As mentioned, the Act adds 22 sections to the Civil Code and amends a 23rd section. Several of the individual sections are many times longer than this article. Implementation is likely to be a months-long project. If you would like our help, send an email to rhamlin@hamlinlaw.com. You may also schedule a Get Acquainted Call or Initial Case Evaluation.
(We published a version of this article for the Out of Home industry in Billboard Insider. Re-published with permission.)