Written by
Keeper Security
Is your company ready for the California Consumer Privacy Act (CCPA)? If not, time is running out to prepare; it takes effect on January 1, 2020. Here’s the lowdown on the CCPA.
What is the CCPA, and who has to comply?
Tired of waiting for the U.S. federal government to take action on consumer data privacy legislation, states have started to take matters into their own hands and pass their own data privacy legislation. The CCPA is the most far-reaching example to date, especially since California is the most populous state in the U.S. and the home to a number of multinational tech companies, including Facebook and Google.
Any company that does business in California has to comply, regardless of whether they have a physical presence within the state.
The CCPA vs. GDPR
The CCPA is often called the “American GDPR,” but that’s not entirely accurate. Unlike the GDPR, which applies citizens throughout the European Union (EU), the CCPA applies only to California residents. The CCPA also doesn’t mandate data breach reporting.
That said, the CCPA borrows heavily from the GDPR and grants California consumers significant new data privacy rights, including:
The CCPA defines “selling” very broadly, to include “disclosing, disseminating, making available, transferring,” and more. Companies will be prohibited from hiding “do not sell” instructions in tiny print within voluminous terms of service. Under the CCPA, they’ll have to include a “clear and conspicuous” section on their website with the specific wording, “Do Not Sell My Personal Information.” If this notice is missing, it’s considered a privacy violation under which consumers can sue.
The CCPA is also very liberal about what constitutes “personal information,” defining it as anything that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Specific examples noted in the law include the real name, alias, geolocation data, IP address, biometric data, professional or employment data, and much more.
Once a business is notified of a CCPA violation, they’ll have 30 days to correct it. Otherwise, they can be fined up to $7,500 for each violation and be subject to class-action lawsuits.
Getting your business ready for the CCPA
An economic impact assessment prepared for the California State Attorney General by an independent research firm estimates that complying with the CCPA will cost very small businesses (fewer than 20 employees) about $50,000 upfront, while companies with more than 500 employees will pay an average of $2 million. Companies that are already GDPR-compliant have a head start and will end up paying less.
In addition to ensuring your data security is sufficient, preparing for the CCPA means shoring up your data management and governance. Here are a few tips:
Keeper’s Commitment
Keeper is CCPA compliant, and we are committed to ensuring our business processes and products maintain compliance for our customers who must comply with the CCPA.
The Keeper Web Vault, Desktop App, Android App, iPhone/iPad App and browser extensions have been already been certified Privacy Shield compliant with the U.S. Department of Commerce’s EU-U.S. Privacy Shield program, meeting the European Commission’s Directive on Data Protection. Keeper is SOC 2 Type 2 compliant in accordance with the AICPA Service Organization Control framework. Keeper is also ISO27001 certified.
Keeper’s Data Processing Agreement (DPA)
Business customers may need to sign a Data Processing Agreement (DPA) with Keeper Security to assist in their CCPA compliance. Please request the DPA agreement from your Keeper representative or email us at business.support@keepersecurity.com.
You May Also Like
The security concept known as “Privilege Creep” occurs when an individual accumulates access rights over time, retaining entry to systems and data beyond the completion of a specific task or the need for such access. This...
Choose Language