Orange County experts say it’s time for affected companies to make sure their data collection is in compliance with the state’s new consumer privacy law where enforcement began July 1st.
The California Consumer Privacy Act, also known as CCPA, lets people know what personal data certain-sized businesses collect, and whether it’s being sold or disclosed, giving them the right to deny the sharing of their information and request deletion of their data. There are also special protections for minors.
It comes at a sensitive moment as pandemic-fueled contact tracing and face recognition give rise to concerns about a loss of control over one’s personal information.
“The website of every business covered by the law must now post a link on its homepage that says ‘Do Not Sell My Personal Information,’” according to state Attorney General Xavier Becerra’s website.
Becerra “thinks that privacy is all the more paramount now than ever because of the COVID situation,” said Usama Kahf, a partner in the Irvine office of national law firm Fisher Phillips.
The general view is that the law will first affect bigger companies. The CCPA, which provides for fines against violators, has already led to class action lawsuits, said Kahf, who is leading his firm’s task force of 17 attorneys giving legal advice on the new law.
$25M-Plus
Businesses covered under the law include those with more than $25 million in annual gross revenue and those that buy, sell, or receive the personal information of 50,000 or more consumers, households or devices annually.
“They want everyone to start complying as soon as possible, but they don’t have enough resources to go after every little offender here and there,” Kahf said. “They’re really more focused on the selling of information.”
The law applies to a wide array of businesses that meet the size criteria, including restaurants and retailers just as some examples.
Working at home poses its own issues.
“Orange County is home to many office-based businesses that have seen their workforce transition to working at home due to the pandemic,” Kahf said. “With telework comes a number of privacy concerns, especially where employees are permitted or required to use their personal devices for work purposes.”
OC Companies
Still many Orange County companies aren’t subject to the new statewide law, said Kahf.
“It’s causing a lot of headaches for people in the business community,” he said.
He stressed that companies need a full inventory of what data they have.
Vishal Oza, senior director at Alvarez & Marsal’s forensic technology practice in Costa Mesa, said on Aug. 3 that companies were already taking steps to meet the act’s requirements.
“Because of the COVID situation, some corporations may be behind in where they would like to be as of July 1 when the enforcement kicked in,” according to Oza.
He pointed out there are several large healthcare, technology and financial companies in Orange County that will have to comply with the CCPA.
“In Orange County, we have attracted many large corporations that will have to comply,” he said.
CCPA compliance starts with data mapping, which means figuring out what data the company is saving, where, how and for how long, Oza said.
“Once they identify the data, they know what are their obligations and what’s relevant to the CCPA,” he said. “You don’t have to worry about protecting the data you don’t have.”
He also pointed out that fines for violations are substantial and there are already moves underway to make the protections even stronger and more consumer focused.
Privacy Care
Scott Jordan, a professor of computer science at the University of California-Irvine and a key member of the new research center there on personal data privacy, called the CCPA “a good step. It’s not the end-all, it’s not the last we’re going to see of this.”
“The academic literature actually shows that the vast majority of people, including young people, really care rather substantially about their privacy,” Jordan said.
The debate is about the collection of personal information when a user wants a service and what is being done to monetize the information, Jordan said.
