This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.

 

California's Consumer Privacy Act, signed into law earlier this year, follows a growing line of consumer privacy laws, such as the European General Data Protection Regulations (GDPR), Canadian Breach of Security Safeguards Regulations of the Personal Information Protection and Electronic Documents Act (PIPEDA), and related New York Department of Financial Services Cybersecurity Rules and Regulations (NYCRR 500).

As New York's NYCRR 500 regulations serve as the gold standard for cybersecurity protocols, California's CCPA will likely serve as the U.S. standard for privacy. Like its European GDPR counterpart, California's privacy act establishes consumer rights and corporate responsibilities, which will be enforced with penalties up to $7,500 per violation.

As motivation for the law, the California Act notably cites the tens of millions of people whose personal data was misused by the data mining firm Cambridge Analytica, a greater desire to heighten data privacy controls and transparency of data practices, and the people's desire for privacy and more control over their information. The Act provides specific provisions:

  • Full disclosure regarding the collection of personal information, including details of the collected information, sources, the purpose, whether the data is disclosed or sold to another party, and if so, the third party's details.
  • An opt-out right to prevent a business from selling their personal information to third parties.
  • The right to be deleted (like with GDPR's right to be forgotten).
  • The right to equal service and pricing, even if the individual exercises their rights under the Act (the net neutrality of privacy).

The Act mandates traceable transparency of consumer data collection, use, distribution, and the GDPR-like right to be forgotten. These requirements must be made public through general policy, by specific request, and cannot form the basis of bias or discrimination on the part of the business. A company cannot tie goods or services to the ability to resell consumer information or offer discounts or other incentives in exchange for this ability. This moves consumer privacy rights from the domain of often ignored fine print to the front page.

The Act, which comes into effect on Jan. 1, 2020, could have a serious impact on the economic models of many companies collecting and reselling data to other parties. Transparency in data movement and resale will open the eyes of consumers who, until now, blindly agree to user contracts and never question why an app on their phone needs access to their location, contacts, or other services.

The Act is similar in a way to the Fair Credit Reporting Act (FCRA) that enforced transparency in consumer credit reporting and gave people the ability to correct errors. Until the FCRA, credit reporting was a dark venture between agencies and banks, with little to no opportunity for consumers to understand how the ratings were determined, distributed or used.

Companies will likely have to expend significant resources to move toward compliance. Opt-out and opt-in mechanisms differ slightly between CCPA and GDPR and require multiple mechanisms. It could lead to confusion both on the company side and for the consumer. While the law is more than one year away, companies should be planning their compliance efforts now, given the timeline and economic ramifications of the law.

Like privacy and security legislation before it, many companies will ignore the Act assuming it doesn't affect them, only to discover that it does. Moreover, many companies may opt to sit back and wait for enforcement actions to hone their cost versus benefits model.

But like other laws, ignorance is no excuse. As we've experienced with data breaches, organizations that aren't prepared and then experience a business altering event will likely take far too long to discover the breach, struggle to resolve the issue and end up fined under the new Act. It's not a new story. We've seen it before with other privacy laws like HIPAA — reviewing the public resolutions and penalties reads like a who's who of cyber sinners. With privacy, the finger pointing throughout the data transfer chain could become dizzying and cause protracted investigations and actions.

So, what should organizations do to prepare for these new regulations?

First, acknowledge that your business is affected because you do control assets (data, records, banking information, etc.). Conduct an assessment to determine what information is collected, for what purpose, and where it moves. Minimize what's collected and start building the opt-in/out mechanisms and procedures to respond to specific consumer inquiries.

Consumer privacy has become a main stage topic, which means similar legislation will appear in other states, further confusing what is already compliance nightmare for national companies.

 

Mark Sangster is a cybersecurity evangelist who has spent significant time researching and speaking to peripheral factors influencing the way that legal firms integrate cybersecurity into their day-to-day operations. In addition to Mark's role as VP and industry security strategist with managed cybersecurity services provider eSentire, he also serves on our Board of Editors and as a member of the LegalSec Council with the International Legal Technology Association (ILTA). He can be reached at [email protected].