The California Consumer Privacy Act ("CCPA") was enacted in early 2018 as a political compromise to stave off a poorly drafted, and plaintiff’s friendly ballot initiative.  Although the CCPA is scheduled to go into force in early 2020, there is a great deal of confusion regarding the requirements of the CCPA, including the degree to which it aligns with other privacy regulations such as the European General Data Protection Regulation (“GDPR”).

To help address that confusion, BCLP published the California Consumer Privacy Act Practical Guide, and is publishing a multi-part series that discusses the questions most frequently asked by clients concerning the CCPA. 

Q. If a company already drafted a privacy notice to comply with other United States laws, does it need to change the notice to comply with the CCPA?

Yes.

There are a number of laws within the United States that require companies to provide people with a notice concerning the company’s privacy practices – a document that is often interchangeably referred to as  “privacy notice,” “privacy policy,” or “information notice.”  On the federal side these include the Gramm Leach Bliley Act (“GLBA”), which requires financial institutions to provide privacy notices to customers, the Health Insurance Portability and Accountability Act (“HIPAA”), which requires health care plans, health insurers, and health care providers to provide privacy notices to patients, the Family Educational Rights and Privacy Act (“FERPA”), which requires educational institutions that receive federal funding to provide privacy notices to students and parents, and the Children’s Online Privacy Protection Act (“COPPA”), which requires that websites which collect information from children provide a privacy notice to parents.  A small number of states have also enacted statutes that require websites which collect information from state residents to provide a privacy notice concerning their online privacy practices, and companies that collect Social Security Numbers to provide a privacy notice specific to their collection and use of that data.[1]

While the various statutes that mandate privacy notices in the United States contain a common core of similarities; almost all of them require that a company:

1. Identify the categories of information collected,
2. Disclose the process (if any) for individuals to request changes to their information,
3. Disclose how the organization notifies individuals of material changes to the privacy policy.
4. Disclose the effective date of the privacy policy.

Beyond this common core the various United States laws have differing requirements.  For example, some state laws require that companies disclose whether or not they honor automated privacy preferences broadcast by users’ browsers, other laws require that companies disclose certain rights of the data subject.  It is worth noting that none of the existing United States privacy laws include all of the substantive components of the CCPA; how far away a company’s existing privacy notice is from the CCPA’s requirement depends upon on the context in which it was drafted, what, other United States laws it was intended to satisfy, and whether it incorporated certain “best practices.” 

The following chart indicates which requirements of the CCPA are likely, or are not likely, to be found in a United States based privacy notice:

1. See Cal. Bus. & Prof. Code § 22575, et seq.; 6 Del.C. § 1201C, et seq.