California now has the most sweeping and comprehensive privacy rights law in the country — The California Consumer Privacy Act of 2018 (the “Act”). Some might say the Act is the result of Cambridge Analytica misusing the data of tens of millions of Facebook users. Others would suggest that the Act is merely the natural and logical progression of inalienable rights of privacy in the digital age. Whatever the reason, California’s Privacy Bill of Rights for consumers will forever change the way businesses collect and use personal information (“PI”).
Here’s the good news: Companies will have a ramp-up period in order to prepare for compliance. Here’s the bad news: Compliance may be challenging, labor intensive, and potentially costly. Starting on January 1, 2020, the Act gives Californians the following privacy-related rights:
(1) The right to know what PI is being collected about them.
(2) The right to know whether their PI is sold or disclosed and to whom.
(3) The right to “just say no” to, or to “opt-out” of, the sale of PI.
(4) The right to access their PI.
(5) The right to equal service and price, even if they exercise their privacy rights.
(6) The right to have their data deleted.
(7) The right to know the sources from which PI was acquired.
(8) The right to know the commercial purpose of collecting PI.
(9) In addition, businesses must create an “opt-in” process whereby parents or guardians expressly authorize the sale of PI of children under 16.
When interacting with consumers who are exercising these rights, businesses must verify the identity of the consumer. Once verified, the business must promptly take steps to disclose and deliver, free of charge, the PI requested. Whether or not such a request is made, at a minimum, a business that collects such PI has the legal obligation to proactively inform consumers about the categories of PI being collected and purposes for which the PI shall be used. Businesses must also inform consumers of their right to have PI deleted. These requirements of the Act may sound simple and straight forward, but designing and implementing a process to ensure consumers access to these rights will likely be an involved and potentially cumbersome process.
The businesses governed by the Act fall into three categories: (1) Companies that obtain the PI of at least 50,000 California residents annually (the “50K Companies”); (2) Companies with 50% annual revenue being generated from selling the PI of California residents (the “50% Companies”); and (3) Companies with annual gross revenues of $25 million (the “25M Companies”). Collectively, the 50K Companies, 50% Companies, and 25M Companies shall be referred to as “Covered Companies”. The 50K Companies may pass the 50,000 threshold fairly quickly, as the scope of what constitutes “PI” is broad. Many companies, big and small, including, but not limited to, professional service providers, bloggers, social media influencers, retailers, music venues, fitness studios, and others operate websites that automatically capture IP addresses, and those addresses likely constitute PI. Websites that are passively accessible to visitors and generate a lot of traffic may surpass the 50,000 threshold without even realizing it. Unlike the 25M Companies, as long as the 50% Companies generate at least one-half of their revenue from disclosing PI for money (even if that revenue is substantially less than $25 million), they will need to comply with the Act; though there are exceptions including business transfers in bankruptcy and M&A transactions.
If a consumer “opts out” of the sale of PI, Covered Companies are prohibited from discriminating against such consumers for exercising this right. To that end, Covered Companies may not charge consumers who “opt out” a different price or provide such consumers with a different quality product or service. All of that notwithstanding, the Act does authorize Covered Companies to give financial incentives to consumers in exchange for allowing them to collect, use and share PI. However, a Covered Company may not sell the PI of a consumer under 16 unless properly authorized by a parent or guardian.
Although the obligations outlined above will not kick-in for more than a year, Covered Companies should start preparing for compliance immediately with regards to both PI already in their possession as well as PI to be collected in the future. Until the federal government passes more comprehensive legislation to match that of California, Covered Companies should, at a minimum, do the following: (1) Identify, inventory and organize all of the PI of California residents in their possession; (2) Prepare updated privacy policies including the additional disclosures required by, and the various consumer rights listed in, the Act; (3) Update and upgrade their technology platforms and software programs to allow for data access, deletion, and portability requests from California consumers; (4) Obtain prior consent from parents to comply with “opt-in” requests related to children under 16; (5) Set up a toll free number for consumers submitting data access requests; and (6) Provide hypertext links on their homepage enabling users to “opt out” of the sale of their PI altogether.
Covered Companies not in compliance by the deadline should expect civil actions to be filed by the California Attorney General’s Office who will look to secure penalties of $7,500 per intentional violation and $2,500 for any unintentional violations, though unintentional violators will be given 30 days to cure. Approximately twenty percent of the penalties collected by the state shall be allocated to a new “Consumer Privacy Fund” to pay for ongoing enforcement. Therefore, Covered Companies should expect enforcement actions to increase, not decrease, over time as the fund grows. To that end, Covered Companies cannot afford to ignore the Act, which the California legislature has requested be “liberally construed to effectuate its purpose.” The best, if not only, course of action for Covered Companies is compliance. There’s a new sheriff in town y’all. And her name is Privacy.
