Still Manual Burden: Most Companies Slow to Automate CCPA Compliance
Automating California Consumer Privacy Act compliance is likely to run into significant to operational barriers. And for some companies, the costs associating with deploying automation may not be worth it.
July 21, 2020 at 10:00 AM
4 minute read
Despite enforcement of the California Consumer Privacy Act coming online earlier this month, many companies are still struggling to comply with the far-reaching state regulation. But it's not just a lack of understanding about the CCPA's requirements that is holding them back. It's also a lack of automation and factors outside their control, according to a new survey of 121 U.S.-based companies by cybersecurity and cloud services company Akamai.
Complying with CCPA requirements are still a somewhat manual process for many companies. Only around a third of survey respondents, for example, said they fully automated showing or allowing customers access to their personal data. Even fewer, 23%, did the same for customer requests to have their data deleted. However, 43% were able to fully automate customers opting not to have their personal data sold by the company.
According to the survey, at least half of all respondents received these four CCPA requests at some point. Less common, however, were customer requests about if and to whom the company sold their private data, at 38% of companies, and those ensuring the company wasn't discriminating against customers because they exercised their CCPA privacy rights, at 22%. These two last requests were automated by only 21% and 28% of companies, respectively.
Steve Winterfeld, the advisory CISO at Akamai, noted one of the biggest hurdles to companies automating their CCPA compliance is the fact many don't store customer data in one central location. He explained that companies often use third-party providers that have access to their customer data regulated by the CCPA.
"Now you have data in a lot of places, and so to automate something like 'what information do you have about me,' you have to pull from multiple places. And to build a system that can integrate all that can be very difficult," Winterfeld said.
For some companies, he added, building such a system isn't economical. "Part of that is how many people are going to require this. … If five people want their data to be deleted, automating it doesn't make financial sense, you won't get a return on investment," he said.
Most companies said the CCPA compliance challenges they faced were both internal and beyond their control. Slightly less than half of all respondents cited a lack of consistency between the CCPA and other privacy regulations (47%) , and a lack of visibility into what data they hold (46%) as a barrier to compliance. Around 40% also said inadequate technology infrastructure and inadequate implementation time were challenges, while 36% cited a lack of data education.
Winterfeld noted the challenge of "data education" includes making sure all departments and employees within a company understand how to comply with CCPA. For example, "you don't have marketing go hire a company that is not compliant with the requirements," Winterfeld said. He said companies have to make sure "data is treated in accordance to those corporate policies that allow the company to be compliant."
While attorneys have a pivotal role making sure employees adhere to regulatory requirements, they are often not the ones overseeing their organization's CCPA compliance. According to the survey, most companies either relied on their chief information officer, 32%, or their chief technology officer, 29%, to manage their compliance effort, while only 18% gave the responsibility to their chief legal officer. Nine percent also had their chief customer officer spearhead the effort, while 8% turned to their chief privacy officer and 3% their chief marketing officer.
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllTrending Stories
- 1Judicial Ethics Opinion 24-59
- 2The American Lawyer Names Industry Award Winners
- 3Regulatory Upheaval Is Coming. How Businesses Prepare and Respond Will Separate Winners and Losers
- 4Cravath Elevates 7 to Partnership, Up From Last Year
- 5Kline & Specter Hit With Lawsuit From Another Former Associate
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250