Kevin Levy, shareholder, and Drew S. Haggard, associate, GrayRobinson.

While the European Economic Area, including the European Union, has led the modern privacy revolution, specifically by enacting and enforcing the groundbreaking General Data Protection Regulation (GDPR), the protection of consumer privacy is also gaining momentum around the globe. In the United States, the California Consumer Privacy Act (CCPA) is leading the way. The CCPA will fundamentally change how businesses interact and handle consumer data by transferring power over such data to the individual. Under the CCPA, individual consumers are granted certain rights to their data that did not previously exist in the United States—outside of the context of the finance and health care industries.

Despite the CCPA taking a less progressive consumer opt-out approach to the collection of consumer data (compared to the GDPR's more consumer friendly opt-in regime), the consumer rights under the CCPA will force businesses to radically change how they process consumer data, including implementing data mapping of all such data collected, stored, shared and otherwise processed. The five consumer rights which will have the biggest impact on how businesses process consumer data are:

Right to Information

Businesses must inform the consumer before processing any of that consumer's personal information about the categories of personal information to be collected, the purpose for which the collected personal information will be used, and if any of the consumer's personal information will be sold by the business, the right of the consumer to opt-out of the sale of his or her personal information. Generally, this is communicated to consumers through a privacy policy posted to the business' website, which will now need to include additional, detailed descriptions of how the business processes the consumer's personal information and be updated every 12 months.

Right to Access

When requested, a business must provide a consumer with the categories of personal information it has processed about the consumer, categories of sources from which the personal information is collected, purpose for processing the personal information, categories of third parties whom the personal information is shared with or sold to and specific pieces of personal information the business has processed. The business must provide the information in a portable and readily usable format that allows the consumer to transfer the personal information to another business without hindrance. This right will force businesses to implement expensive and resource consuming data mapping procedures to ensure they are able to comply.

Right to Deletion

When requested, a business must delete all the personal information of a consumer. This right stems from the GDPR's controversial "right to be forgotten," however the CCPA includes a First Amendment exception. The EU now appears to have realized that a balance is required for this right, as the EU's highest court recently held such an exception is applicable. Unfortunately, this right still puts the onus on businesses to make tough legal decisions about the applicability of such an exception and will also require implementation of expensive and resource consuming data mapping procedures when such an exception is not applicable.

Right to Opt-Out of Sale

If a business sells any personal information of a consumer, the business must provide the consumer with a link on its homepage, titled "Do Not Sell My Personal Information," which the consumer can use to opt-out of the sale of the consumer's personal information. Separate rules apply to children of various ages, including opt-in requirements and parental consent. Without proper planning, this means that in the event of a merger or acquisition, consumers have the right to opt-out of their personal information transferring to the resulting entity, which can have a material adverse effect on the value of the business being sold.

Right to Not Face Discrimination

The CCPA prohibits a business from denying a consumer goods or services, charging different prices, or providing different quality goods and services because the consumer exercised any of his or her rights under the CCPA. However, upon express opt-in consent of the consumer, a business may offer financial incentives for the collection, sale, or deletion of their personal information. It will be interesting to see if these rules prove more fruitful in protecting consumer privacy or drive consumer freedom to direct how their personal information is used.

Recent Developments

There is some positive CCPA news for businesses. Five pro-business amendments were recently signed into law.

Specifically, these amendments:

• Exempt personal information of employees and job applicants until Jan. 1, 2021.
• Exempt personal information related to business-to-business communications and transactions until Jan. 1, 2021.
• Exempt de-identified and aggregated consumer information and expand the scope of the exemption for publicly available information.
• Partially exempt personal information necessary for vehicle warranties and vehicle recalls.
• Remove the requirement that businesses operating exclusively online provide a toll-free number to receive consumer requests.

In addition to the initial law and these amendments, businesses need to continue to monitor and evaluate the CCPA as further clarity is expected to be provided in the legislatively mandated California Attorney General regulations, the first draft of which were released on Oct. 10.

What to Watch for Next

The GDPR and the CCPA have increased the momentum of the federal government and several U.S. states to consider enacting more encompassing and stringent data privacy regulations. Even if the CCPA and other data privacy regulations being adopted in America are less progressive than the regulations enacted in Europe, U.S. companies not conducting business in the EU still need to prepare for the changes coming to the U.S. market or risk violation of applicable law, loss of consumer confidence and loss of market value.

Kevin Levy is a shareholder at GrayRobinson in Miami, and Drew Haggard is an associate in the firm's Fort Lauderdale office. Levy chairs the firm's technology transactions practice. Contact him at [email protected]. Haggard advises on compliance with the European Union's General Data Protection Regulation and U.S. privacy laws. Contact him at [email protected].