Alert - Immediate Action Needed Under California’s New Privacy Law (1-Year Look Back Provision)

While 2018 was all about GDPR Compliance, 2019 will be the year of the California Consumer Privacy Act, or "CCPA." If you haven’t heard, the CCPA is consumer privacy legislation that was passed on the heels of the GDPR deadline last year; however, the CCPA does not go into effect until January 1, 2020. While many have described the CCPA as similar to the GDPR, privacy attorneys and experts alike are frustrated with inconsistencies between the two regulations that will make it difficult for Internet-based businesses to comply with both using a single privacy framework. As such, several business associations and legal organizations have lobbied California legislators to make needed changes to the CCPA before it goes into effect next year.

Although we still have roughly eleven months to worry about the CCPA, there is an important provision within the statute that requires your compliance NOW. The CCPA includes a 12-month "look back" provision that allows consumers to access how their personal information has been used by your business over the past twelve months. Thus, when the CCPA goes into effect on January 1, 2020, a consumer who inquires on that date must be able to look back to January 1, 2019. We’re providing you with this notice so that you can alter your records retention and auto-deletion policies now to preserve this information for later compliance.

Perhaps you’re not located in California and are wondering if the CCPA applies to you. By its terms, the CCPA requires compliance from any business (whether located in California or not), that meets the following criteria:

• The business (or individual, if a sole proprietorship/DBA) collects personal information from consumers, or has others do it for them;
• The business does business in the State of California; and
• The business either:
  • Has annual gross revenue of $25MM or more,
  • Makes 50% or more of its annual revenue from selling consumers’ personal information, OR
  • Deals with the personal information of at least 50,000 consumers, households, or devices (alone or in combination) per year.

Our firm is tracking developments regarding the CCPA closely so that we can provide clients with updated advice as the effective date approaches. For now, we need you to do your part by ensuring you are maintaining the necessary consumer personal information and records regarding how such information was used by your company.