The California Consumer Privacy Act — The Next Y2K for Businesses?
The California Consumer Privacy Act (the “CCPA”) was passed in June 2018 and will take effect on January 1, 2020. Dubbed “GDPR Lite” to reflect its similarities to the EU’s monster privacy law, the CCPA is expected to be a game-changer for U.S.-based companies that process sensitive data. As it stands today, CCPA will apply to all for-profit businesses that collect and control California residents’ personal information, “do business” in California and have annual gross revenues in excess of $25 million (to name just one way it can apply to you).
For the unwary, this may be brushed aside as a California-company issue; however, companies that do business online and have overall revenues in excess of the threshold—not just from California—should take note. CCPA has detailed disclosure requirements, a grant of extensive rights to individuals over how their personal information is used, statutory fines and a private right of action.
Heather Bailey, Partner, SmithAmundsen
Molly Arranz, Partner, SmithAmundsen