Smart Business
(by Jayne Gest with Justine Kasznica)
In 2018, California signed into law the first state-level comprehensive privacy act, the California Consumer Privacy Act of 2018 (CCPA), which goes into effect Jan. 1, 2020. Due to the CCPA’s broad scope and reach beyond California, as well as its large fines and penalties for noncompliance, the law is influencing and setting a high bar for data protection practices nationwide. Since the CCPA was signed, several states have proposed or enacted similar legislation, turning privacy and cybersecurity into a patchwork of state-led experimentation.
“More states are developing privacy laws, which will make it difficult for companies to track and comply with every state’s privacy act, not to mention the privacy regimes in non-U.S. jurisdictions, such as Europe’s General Data Protection Regulation (GDPR),” says Justine Kasznica, shareholder at Babst Calland.
In the absence of a uniform approach to privacy and cybersecurity, businesses need to be aware of the state, federal and foreign laws being introduced and enacted — even if their operations are not yet affected.
Smart Business spoke with Kasznica about how California’s privacy law, and others, will impact companies.
How does California’s privacy act work?
The CCPA protects consumers who are residents of California, giving them rights to disclosure, access, deletion and control (opt-out and portability rights), as well as imposing a prohibition on antidiscrimination. It also addresses the data privacy rights of children under the ages of 13 and 16.
The CCPA is modeled on the GDPR, articulating similar consumer rights (even if terms differ) and imposing business obligations and enforcement mechanisms. While compliance with GDPR may facilitate CCPA compliance, the two privacy regimes deviate in their definitions of personal information/data, scope of the rights protected, affected organizations, and penalties and enforcement. …