CCPA: Get Your Business Ready With Marit Davey

Introduction

These days, consumer data privacy and issues arising out of its breach is a growing concern worldwide. With the growth in the number of online transactions carried out each day and each hour, more and more companies have free access to private, and sometimes even sensitive, information of their customers. There have been real-life instances in which the companies misused this information and/or it was not protected to the degree to which it should have been. As a result, we have several examples of consumers falling prey to identity thefts and financial fraud.

There has been a worldwide uproar against the breach of consumer privacy time and again. As both people and governments realised the importance of protecting sensitive consumer data, many countries around the globe passed laws and legislations about the same. One such law that is in practice in California today is the California Consumer Privacy Act, commonly known as CCPA. The sole purpose of this law is to regulate the extent to which businesses worldwide can use the personal and sensitive information of California’s residents.

In a webinar held in association with MoEngage, Marit Davey, a data privacy compliance expert from California, spoke about CCPA, its applicability, and its impact on global businesses.

The Story Behind CCPA

There is actually a very interesting incident behind how and why CCPA came into being in California. One day the real estate giant, Alastair Mactaggart, was in conversation with one of the engineers at Google. The story goes that the engineer taunted Mactaggart several times during the chat about the amount of private information Google had on the latter. And the undertone of what the engineer was saying was that there was nothing that could be done about it and that it was possible for Google to use this information in any way possible. This got Mactaggart worried as it triggered the thought that if Google had access to his information, there could be multiple others who might have the access too, as most things happen online these days.

This thought got the real estate mogul restless, and he decided to do something to protect consumer privacy. He hired a consultant shortly and, after much brainstorming and discussion, placed an initiative regarding the same on California’s 2018 ballot. Soon after, the state’s lawmakers were plugged into the initiative and CCPA was finally passed as a law in California on 28th June 2018. The law, however, became effective in the state from 1st January 2020 onwards.

After CCPA’s enforcement, all California residents now have the complete right to ask companies to disclose how much and what personal data they have collected. Moreover, the consumers also have a right to ask businesses to delete their data if they feel it is too personal and/or sensitive to share. In a nutshell, CCPA attempts to empower the consumers to ask for full disclosure and choose whether or not they want to share their personal data. All big and small businesses having California’s residents as their customers are under CCPA’s radar.

CCPA: Applicability and Scope

CCPA, as mentioned above, applies to every business that serves California’s residents. This means that even if a business doesn’t have a physical office in California but caters to the state’s residents, the law applies. The Act doesn’t really categorise businesses into physical entities and online entities, which is why the location of the business doesn’t matter. Even if it is an online business functioning out of some other country, the law still applies if its customers are Californian residents. The crux of the law is to determine why the given business is collecting consumers’ personal information and how it is going to use it.

CCPA clearly defines the meaning of “personal information”. According to the law, any information that either directly or indirectly describes, identifies, or is linked to a particular individual or household comes under this umbrella. In simpler terms, things such as name, address, phone number, email and IP address, social security number, passport number, etc., comprise “personal information”. But that’s not all. It includes biometric data, online behavioural patterns of consumers, and their digital transactions as well. In short, any data that a business may use for the purpose of consumer profiling is covered under CCPA.

CCPA also regulates and controls the selling of personal consumer data by businesses. Under this Act, the term “selling” includes any exchange of personal data “for either monetary or other valuable consideration.” Simply put, it states that a company cannot give access to its customers’ personal data to another party for money. However, the term “other valuable consideration” hasn’t been clearly explained in the law, which leaves out some scope for interpretation.

Consumer Sentiment and What Companies Need to Do

Customer trust plays a vital role when we speak of data protection and consumer data privacy. It is shocking to know that only 10% of American consumers believe that they have control over their personal information. In comparison, 88% say that they will only share information if they completely trust the company or will take their business elsewhere. Despite the enforcement of CCPA, there are still serious concerns about how businesses handle and use the information they have about their customers. This is also one of the primary reasons numerous lawsuits relating to data privacy pending in courts.

There is no doubt that all businesses dealing with Californian clients need to comply under CCPA. They need to ensure that all their consumer data is well protected and should be able to present it to customers whenever requested. Moreover, they should also delete all data which their customers request them to. But above all, they should keep updating all the latest privacy notices and policies regularly on their websites to constantly keep their customers in the loop regarding the latest developments concerning the protection of their personal information.