California just passed the California Consumer Privacy Act of 2018, expanding the data privacy rights of California residents in an unparalleled step. All employers should be aware of the Act and prepared to meet its requirements come January 1, 2020, the date it goes into effect.
Put simply, the Act provides consumers who are defined as California residents with five basic rights in relation to their personal information:
1. The right to know. This includes what personal information is being collected, whether this personal information is sold or disclosed, and to whom.
2. The right to deletion. A consumer can request deletion of personal information from business servers and service providers.
3. The right to opt out. And say no to the sale of personal information.
4. The right to access. A consumer has the right to access their personal information.
5. The right to equal service. This entails equal service and price, even if the consumer exercises their privacy rights.
What is Personal Information?
The Act takes a broad approach to defining personal information, including non-publicly available “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” What exactly does this mean? Your legal counsel will be able to cover the expansive reach of the Act with you.
How Will the Act Work?
The Act is intended to adjust how businesses amass and sell consumers’ personal information. For example, businesses will be required to make certain disclosures to consumers via their privacy policies or at the time the personal data is collected.
Additionally, businesses must disclose that they sell consumer data and give consumers the choice of opting out via a link titled, “Do Not Sell My Personal Information.” There are specific rules in place for dealing with minors, as well.
What Businesses Must Comply With the Act?
To fall within the scope of the Act, a business must collect and sell personal information as well as meet one of three additional criteria:
1. Have $25 million or more in annual revenue; or
2. Possess the personal data of more than 50,000 “consumers, households, or devices;” or
3. Earn more than half of its annual revenue selling consumers’ personal data
For more information on how to prepare for the California Consumer Privacy Act of 2018, contact experienced business lawyer Drew E. Pomerance today.
