The California Consumer Privacy Act (“CCPA”) grants new rights to California consumers, took effect on January 1, 2020. In response, businesses must take on new obligations.

What new rights do consumers have? Consumers now have the right to know what personal information is collected, used, shared, or sold, as well as the right to request the deletion of this personal information from businesses and a business’s service provider. Further, consumers have the right to direct a business not to sell their personal information. Lastly, the CCPA prohibits businesses from discriminating against consumers for exercising their rights under the CCPA.

Which businesses does the CCPA affect? The CCPA applies to legal entities that are organized or operated for profit, do business in the State of California, collect consumers’ personal information, and satisfy one of the following thresholds: a) have annual revenues in excess of $25 million; b) annually buy, receive for commercial purposes, sell, or share consumer personal information of 50,000 or more consumers; or c) derive 50% or more of its annual revenue from selling consumer personal information.

What does this mean for businesses subject to the CCPA? Before collecting consumer information, businesses must notify consumers of what personal information is being collected and the purposes of the collection. Businesses must also provide a way for consumers to exercise their rights under the CCPA, such as a mechanism to submit requests for personal information, deletion, or to opt-out. A toll-free number or a website address will suffice. Businesses must then comply with any verifiable consumer request received.

Why should a business, as an employer, care? The CCPA necessitates the creation and implementation of a procedure to organize and collect data to timely respond to consumer requests as part of a businesses’ privacy practice. The CCPA explicitly requires that all individuals responsible for handling consumer inquiries about the business’s privacy practices are informed of the requirements under the CCPA and know how to direct consumers to exercise their rights under the CCPA. Thus, employers should train consumer-facing employees on the requirements of the CCPA, any newly implemented data collection procedures, and how to respond to consumer requests and inquiries.

For a printable PDF of this article, click here.