- On 28 June California’s governor signed the California Consumer Privacy Act, which will apply from 1 January 2020.
- It recognises rights of access, deletion and opt-out from sale of personal data for California residents.
- It affects companies from any country that do business there and exceed certain thresholds: assess whether it reaches you.
On 28 June 2018 California Governor Jerry Brown signed the California Consumer Privacy Act, the state’s consumer privacy law, which will apply from 1 January 2020. The law was passed within days, to prevent a ballot initiative on the same subject from going to a vote in the November elections.
It comes barely a month after the European general data protection regulation began to apply, and it is regarded as the most ambitious privacy law in the United States, which has no general federal law on the subject. For companies with Californian customers, even if not established there, it is a new framework to understand.
What rights it recognises
The law grants consumers, who are California residents, several rights: to know what personal data a company has collected about them, to know whether it is sold or disclosed and to whom, to access that data, to request its deletion and to opt out of the sale of their information. It also prohibits discrimination against anyone who exercises these rights.
The approach differs from the European one. The Union’s regulation requires a legal basis to process data, such as consent or legitimate interest, whereas the Californian model starts from the freedom to collect and use data, but gives consumers the right to limit its sale. Even so, both share principles such as transparency and individual control. One consequence of this approach is that consumers must be able to ask for their data not to be sold through a simple mechanism, and the company must inform them clearly, for example with a visible link on its website.
Who it affects
It applies to for-profit companies that collect consumers’ personal data, do business in California and meet certain thresholds of revenue or volume of data processed, or that derive a significant share of their revenue from selling personal information. It does not matter where their headquarters are: what counts is activity in the state. The United States has no general federal data protection law, so each state may regulate on its own, and California’s law could serve as a model, or a contrast, for other initiatives.
Breaches can be penalised by the state’s authorities, with fines per violation, higher if intentional. In the event of data security breaches, the law also provides that consumers may claim damages, which increases the risk of class action litigation. In addition, the law includes a special regime for minors’ data, requiring reinforced consent before it can be sold.
What to review
European companies with customers in California should assess whether they exceed the thresholds and, if so, prepare an inventory of the personal data they process, where it comes from and with whom they share it. Processes already established to comply with the European regulation can be a good starting point.
There is time until 2020, but the law may change during the legislative process and its application will be fleshed out through regulations. It is worth following developments and consulting an adviser with knowledge of US law. This information is general and is not legal advice. Since the timetable until 2020 allows changes, the text is likely to be amended before it applies; meanwhile, a data inventory remains useful, because it helps comply with any privacy rule.
Privacy is no longer a matter for a single jurisdiction: it belongs to each customer.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
