The California Consumer Privacy Act (CCPA) is barely in full swing, and regulators have already pushed through an update, proposition 24.Proposition 24 and the updates to the CCPA have left many businesses confused about the state of their privacy compliance.
It is not often that you find yourselves amid a data crisis, but when you do, you’ll be thankful for all the prior effort you put into designing a response plan.
This article will examine the basic approach to data breach response planning and the steps involved.
The regulatory landscape has shifted once again, and California regulators have pushed through new CCPA website requirements.
Following proposition 24, organizations will now have to address the changes to the CCPA.
Join us in this article to explore what these new changes mean, how they affect your business, and how you can become CCPA website compliant.
No one likes to feel like big brother is spying on them, but they sure do love the conveniences of modern technology.
Some would say these two factors go hand in hand and that to have modern conveniences, you must sacrifice some of your privacy. So let’s debunk that myth.
Imagine yourself as a digital frontiersman traveling across cyberspace into all the different websites you visit, leaving behind an echo of your travels. Like an explorer of the 1700s, your personal data does the same thing, leaving its mark on all the internet islands. But we must beware of pirates!
California has made changes to its consumer privacy act. Some of the changes will affect how companies do business with state residents. The most notable changes apply to websites. There are new requirements and stiffer penalties for organizations that don’t meet CCPA standards.
Voters passed the California Privacy Rights Act (CPRA) or Proposition 24 on November 11th, 2020. While the new law doesn’t go into effect until January of 2023, organizations are already taking steps to ensure compliance.
The California Privacy Rights Act (CPRA) was passed at the end of 2020. It bolsters the California Consumers Privacy Act that is already being enforced across the state. Any company or organization with consumers or clients in California must meet the compliance standards of privacy acts’ compliance standards. When looking at CCPA vs. CPRA, it’s not always easy for businesses to understand its meaning.
In this article, you learn the differences between California’s privacy acts and how it could affect your business.
Consumers have specific rights that are outlined in the CCPA.
Any company that meets one or more of the following three standards is subject to CCPA guidelines. They are:
The CPRA is an extension of the CPPA. Businesses still have to follow the same standards set down in the CCPA. However, the new consumer privacy rights act expands on the regulations set down by the first law. It closes some possible loopholes and strengthens weak points in the original act.
Some procedural nuances are still being revised by the California Attorney General and won’t be finalized until July 1, 2022. With the CPRA regulations going into effect on January 1, 2023, businesses have time to meet the new consumer privacy standards.
The CPRA California privacy act does not replace the CCPA, but it does add to it and strengthen some of the act’s existing standards. The new consumer rights act includes additional provisions for third-party vendors, beefs up compliance standards enforcement, and requires companies to perform regular cybersecurity audits, along with risk assessments. Here’s a closer look at the differences between CCPA vs. CPRA.
Assess your CCPA compliance
Any for-profit organization with $25 million and more in annual gross revenue must follow CPRA standards. It hasn’t changed since the passage of the first consumer privacy protection act. Neither has the threshold for annual revenue from selling California residents’ personal data. It remains at 50% and up. What has changed is the CPRA now includes businesses that also share consumers’ personal information.
Businesses that meet one or more of these thresholds are liable for non-compliance issues under the CPRA.
Employee exemptions under CCPA expired January 1st, 2021, but the new act extends the deadline to January 1st, 2023. The extension is designed to give employers and employees more time to handle the details regarding the storage, handling, and use of workers’ personal data.
Businesses have the right to collect employee data that includes names, addresses, phone numbers, social security numbers, along with emergency contact information. While employees must provide the requested information, they cannot opt-out like consumers under either privacy act; they do have certain rights.
Employees can request employers to reveal how their information is being used. Employees also have the right under CPRA to request private action when a security breach involving their data occurs. With the extension, companies have more time to address these concerns and respond to employees in a cybersecurity breach.
The CCPA includes four consumer rights supported under the new CPRA guidelines that also come with two additional ones.
Both the CCPA and CPRA give consumers the right to:
The two additional rights under CPRA are;
Both California privacy acts cover personal information, but the definitions differ. CPRA California takes it a step further. According to the CPRA, personal data is defined as any information linked to a person or household. Due to the original act’s relatively vague wording, companies can find potential loopholes in what is considered identifiable information.
CPRA provides a more definitive definition for personal information and also includes sensitive personal data that includes,
Even though third-parties were included in the CCPA, it was limited to service providers. It included any vendor that processes personal data for the business, payment authorizers, along with product or service providers. Still, it did not cover all third-party organizations companies often do business with.
The California Privacy Rights Act includes third-party contractors. It effectively closes all loopholes regarding sharing consumer data with any organization under contract with the business. Consumers have the right to know who their data is being shared with or sold to, and can opt-out for any reason.
One of the areas with the most significant changes is the enforcement of the consumer privacy act. Previously, it was up to the California Attorney General to pursue violations. Businesses had 30 days to resolve the complaint before facing fines levied by the state’s AG. Consumers also have the right to take private legal action if their personal information was breached.
Consumers still have the right to take civil action, but the AG is no longer responsible for enforcing privacy act violations. The California Privacy Protection Agency has been created and will guide business, along with enforcing compliance violations. Another change, businesses no longer have a 30-day grace period. Instead, they can face fines immediately after the breach is reported.
The CCPA and CPRA define selling data as an act for monetary or valuable gain. The California Privacy Rights Act also includes sharing information in its standards. When a business gives third-party access to data for advertising that benefits the company without money being exchanged, it is considered sharing.
Consumers have the right to know who the business is sharing or selling their information. They also have the right to opt-out of the practice.
The California Consumer Privacy Act did not limit data usage, but this changed with the passage of the CPRA. The new act limits the collection, storage, and use of identifiable consumer information to what is necessary to exchange goods or services successfully. Companies cannot gather, retain, or use data that is not necessary or no longer needed.
Consumers have the right under both California privacy acts to pursue a private right of action if the unencrypted or unredacted data is breached due to negligence on the company’s part. CPRA California gives consumers additional rights. They can employ civil actions against a business for not having or maintaining security measures for unencrypted/unredacted information and data pertaining to email addresses, passwords, and answers to security questions.
The CPRA covers all identifiable information that can lead back to the individual, household, or allow a hacker to access their accounts.
The passage of the CPRA simplifies the potential fines businesses can face to violate a minor’s personal information. CCPA penalties range from $2,500 for an unintentional security breach to $7,500 for an intentional one.
As of January 2023, there will be an automatic $7,500 for each violation, regardless of how it occurred, for each violation of a minor’s personally identifiable information.
Businesses will notice the most significant changes when it comes to performing risk assessments and audits. Previously, these proactive tools used to prevent cybersecurity breaches were not a required part of the California Consumer Privacy Act. Due to the other cybersecurity acts in-place in the U.S., Canada, and Europe that require audits and assessments for compliance, California legislatures did not feel it was necessary to include the standard in its privacy act.
The passage of CPRA changed this. Annual cybersecurity audits are required by businesses that process data. The terms are vague. The standard only applies to companies whose practices may put protected data at risk. A CPPA risk assessment is also required of these businesses. The confusion over this provision stems from knowing if your security practices are putting protected data at risk.
CCPA did not address automated decision-making or profiling, but CPRA has addressed it. Profiling is no longer allowed. Profiling is when an automated data processor uses a consumer’s information to determine specific characteristics like health, reliability, and job performance.
When automated profiling is used, companies must give consumers the option to opt-out without any recriminations.
Most businesses will notice that meeting the new compliance standards isn’t difficult if they follow CCPA guidelines. Though, there are some changes companies will need to implement.
The most noticeable is the inclusion of assessments and audits. A risk assessment will highlight your cybersecurity protocols’ problem areas, and the audit will ensure that your company complies.
Not every company performs annual assessments or audits, and this is where the experts at RSI Security can help. The dedicated team will also explain the differences between CCPA vs. CPRA and what it means to your business.
In 2018, the Facebook-Cambridge Analytica scandal came to light, raising serious questions about how consumer data was being used. Later that year, California enacted the Care About California’s Privacy Act (CCPA) requiring more data transparency and giving consumers more privacy rights. The Act grants California residents greater control over how their data is collected, stored, shared, or sold. Is your business complying with the new CCPA regulations?
CCPA 2.0 compliance is necessary for businesses in the state of California. Learn about future privacy regulations under consideration at the federal or state level for the upcoming November 2020 ballot.