What is CCPA? CCPA Review

CCPA Regulations

CCPA gives consumers more control over companies’ collection and management of their personal information and regulates how companies collect and process data.

First, it stipulates that consumers have more control over companies’ collection and management of their personal information;

Second, it draws a red line for the way companies collect and process data.

CCPA specific content

Privacy

The California Consumer Privacy Organization website highlights the purpose of CCPA:

California consumers own and control their personal information.

Companies have a responsibility to protect personal information.

Large businesses are held accountable (and may have to pay fines) for failing to protect personal information.

These concepts manifest five personal information rights.

Specifically, California residents have the right to:

· access his or her personal information;

Delete personal information;

Understand what personal information the company collects or sells;

· Opt out or opt in and not be eavesdropped on after opting out;

·Not disclose his or her personal information.

Each of these rights may require businesses, including e-commerce businesses, to change or adjust notifications, reporting, and responses.

Due to the complexity of GDPR, it may be relatively easy for some sellers to comply with CCPA. Although there are differences in definitions and requirements, companies that have already complied with GDPR should be well-positioned to comply with CCPA.

Who does CCPA apply to?

1. Annual sales exceeding US$25 million;

2. Processing the personal information of 50,000 or more consumers, households, or devices;

3. Earn 50% or more of annual revenue by selling consumers’ personal information.

In addition, companies that are not directly subject to the Act may also be subject to it if they do business with or provide services to the above-mentioned companies.

CCPA Penalties

Businesses that violate privacy protection requirements will face up to $750 in damages per consumer and civil penalties of up to $7,500.

In addition, companies are prohibited from selling the personal data of minors under the age of 16 without their authorization, and for children under the age of 13, their parents' permission is required.

Companies need to disclose what information they have collected and what relevant data they have deleted based on consumer requests. If they violate the bill, companies will face civil penalties of up to $7,500 and pay up to $750 in compensation to each consumer.

Impact of CCPA on Chinese Enterprises

First, determine whether you are subject to CCPA jurisdiction;

Conduct a gap assessment between the company’s current practices and CCPA requirements;

Prepare and execute work plans to achieve compliance in a cost-effective manner, leveraging existing GDPR compliance work where applicable;

Understand the nuances of CCPA and GDPR provisions, such as identifying business entity partners as service providers, third parties, or other matters required by law;

Carry out compliance work, including:

(a) Conducting data inventory;

(b) designing processes to respond to individual rights demands;

(c) drafting privacy notices;

(d) Preparing contracts, including updating GDPR Data Processing Addenda (DPAs) to cover CCPA.