Blog

CCPA Exemptions: The California Consumer Privacy Act and the Gramm-Leach-Bliley Act

ZenGRC Team · February 13, 2020 ·

A change is coming for privacy protection. Are you ready? For the past twenty years, most financial services businesses fell under the requirements of the Gramm-Leach-Bliley Act (GLB Act or GLBA). This law federally governed the collection and disclosure of customers’ personal financial information.

However, on January 1st, 2020, a new privacy rule-the California Consumer Privacy Act (CCPA)-is going into effect. Although a state law, it may significantly enhance data protection requirements in the U.S.

Does your business fall under this new Rule? Compliance with the GLBA does not mean your business won’t have to adhere to the CCPA. The CCPA does not exempt financial institutions or companies that provide financial services, but there are limited exemptions for certain types of information that are subject to the GLBA.
As stated in the California Code [CCPA § 1798.145(e)], the CCPA does not apply to personal information that is collected, processed, sold, or disclosed under the Gramm-Leach-Bliley Act, and implementing regulations, if it conflicts with that law.
To understand if your company must comply with the CCPA, review the GLBA and the fundamental elements of each law.

What is the GLBA?

The GLBA (also known as the Financial Services Modernization Act of 1999) impacts financial institutions, as well as businesses that aren’t typically defined as financial institutions. It includes businesses that are “significantly engaged” in providing financial services or products and receive that type of financial information. For example, non-bank lenders, real estate appraisers, payday lenders, professional tax preparers, and check-cashing businesses, fall under the GLBA’s definition of “financial institutions.”

The three main components of the GLBA intended to protect the privacy of consumers’ financial information are:

The Financial Privacy Rule
The Safeguards Rule
The Pretexting Protection

Under the Safeguards Rule of the GLBA, companies that meet the definition of financial service institutions must have a written information security plan. Among other requirements, the written plan must describe the methods used to protect customer’s information, and it must incorporate risk assessments, evaluations of the program, and monitoring. The Safeguards Rule also requires financial institutions to ensure contracted service providers are following appropriate data protection if they are handling customer information.

The Financial Privacy Rule applies to the collection and disclosure of personal financial information. Entities that fall under the GLBA Privacy Rule must inform customers about their information-sharing practices. And further, the business must explain customers’ right to opt out if they do not want that information shared with third parties.

The Pretexting Protection provision of the GLBA prohibits access to customer’s financial data under false pretenses, such as fraudulently seeking private information.

Data covered by the GLBA includes non-public personal information or personally identifiable information, such as names, addresses, and phone numbers, bank and credit card account numbers, income and credit histories, and Social Security numbers of customers.

What is the CCPA?

The purpose of the CCPA is to offer broader privacy protections and greater personal control of data collected by businesses.
Various consumer rights are guaranteed by the CCPA, including:

The right to know all data collected by a business, including categories of data prior to its collection
The right to be informed of any changes to data collection
The right to know categories of third parties with whom the consumer data is shared
The right to refuse the sale of personal information
The right to pursue litigation against companies who were negligent with personal data
The right to know the business or commercial purpose for collecting consumer data

Under this rule, if consumers request the deletion of data they have posted, the business must comply. Additionally, consumers also have the right to be treated without discrimination if they request the deletion of data. For adult consumers, there is an opt out for data collection, but a mandatory opt in for the sale of minors’ data is included in the CCPA protections.

Companies impacted by the CCPA include those entities thatwho do business in California, as well as those who sell services or goods to California residents, even if the entity is not physically located in California.

And the main course on this buffet of data privacy protection is that the CCPA has different definitions for personal information, which directly impacts most financial service companies.

What About CCPA Exemptions?

The CCPA defines personal information as any data that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

In short, information collected which builds a profile of a consumer, or the household of the consumer will likely fall under the CCPA requirements. By contrast, the GLBA is only applicable to personally identifiable financial information, such as information that a consumer provides to obtain a loan or financial product or information that results from a consumer transaction.

Likely exemptions are data that is directly generated from consumer transactions or experience information with a financial service business. Additionally, exemptions may also include information that is collected by a financial service business and transferred to another financial service business for the purpose of providing joint financial products, such as a loan or credit card provided by another financial service to the same consumer.

Website or mobile app information from consumer access or in providing a financial product, such as cookies or data that consumers use to access accounts, would be exempt, as this personal information falls under the GLBA provisions.
Credit reports, from a consumer reporting agency, would also fall under exemptions. As would publicly available information, provided it is used in a manner consistent with the purpose of the public information.

It is important to remember that while the information gathered, collected, stored or used above may fall under the GLBA exemptions, passive information or information used for advertising or marketing, and most third-party information would fall under the requirements of the CCPA.

The context of data and the applications of that data determines whether the information falls under the CCPA or is exempt. Reviews of databases and examination of data elements should be performed by financial service businesses to ensure compliance with the CCPA.

What is the CCPA’s Private Right of Action?

Libby Bevin · February 6, 2020 ·

The private right of action provision of the California Consumer Privacy Act (CCPA) is one of the penalties stipulated for non-compliance with the law. It allows consumers to sue companies that have failed to implement reasonable data security measures if their nonencrypted or nonredacted personal information is exposed in a data breach or exfiltration.

Under the California law, a company that suffers a data breach has to notify California residents whose personal information was affected. Californians have several private rights of action.

For an action of statutory damages, the plaintiff must give a company 30 days to “cure” the alleged violation before filing a lawsuit.

However, a consumer who intends to sue a company solely for financial damages is not required to give that business any notice.

The CCPA requires covered businesses to disclose the business or commercial purpose for collecting or selling a consumer’s personal information.

For a detailed look at CCPA penalties and other provisions of the law, check out our CCPA guide.

When does the ‘private right of action‘ apply?

California consumers have a private right of action when their non-encrypted and non-redacted personal data is “subject to unauthorized access, exfiltration, theft, or disclosure due to a business violating their duty to implement and maintain reasonable security procedures.” This provision makes strong cybersecurity measures a must in any business regulated by the CCPA.

Under section 1798.150 CCPA’s private right of action includes the availability of statutory damages.

Most data breach and privacy laws require proof of actual damage and don’t provide statutory damages.

The CCPA private right of action departs from the standard applied by federal courts in the past, which require some form of injury when a breach occurs. CCPA allows suits for statutory damages without evidence of actual damages.

The three key elements that must be present for a private right of action under the CCPA are

Non-encrypted and non-redacted personal information
Unauthorized access and exfiltration, theft, or disclosure
Failure of the business to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information

CCPA’s private right of action provides a narrow definition of personal information which includes:

Social Security number
Driver’s license number or California identification card number
Account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account
Medical information or health insurance information

What types of action does the CCPA allow?

California consumers who experience a data breach can pursue several different remedies.

The private right of action provision of the CCPA lets a consumer bring an individual cause of action or class action against a business even if the individual didn’t suffer any actual damage from the breach.

This provision better ensures that victims have standing to file lawsuits. Under U.S. Supreme Court jurisprudence, plaintiffs in class-action data breach lawsuits have had a difficult time demonstrating that they’ve suffered financial or other damages as a result of a breach of their personal information.

However, the CCPA’s private right of action provision potentially removes this roadblock by providing for statutory damages “in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater.”

The CCPA, which enhances privacy rights and consumer protections for California residents, went into effect Jan. 1, 2020. The California Attorney General’s Office was to begin enforcing the law on July 1, 2020.

Does my business need to comply?

CCPA compliance is required of large companies that do business in California or those that make the sale of data a central piece of their operations. The privacy law also applies to out-of-state companies that do business in California, including those collecting the personal information of California residents and deciding how to process and use that information.

Signed into law by Gov. Jerry Brown on June 28, 2018, the CCPA is the first United States law that offers consumers privacy protections similar to those offered by the European Union’s General Data Protection Regulation (GDPR). There is no federal law like the CCPA.

The Debut of Advanced ZenGRC Risk Management

ZenGRC Team · February 5, 2020 ·

Written by: Scott Nash, VP of Product

ZenGRC’s mission is to connect the people, processes, and technologies critical to our customers information security risk and compliance management. As InfoSec becomes increasingly more complex, our customers want to become more agile in their risk management strategy. It is important for them to have better visibility and be able to respond to changes quickly.

We’ve built upon ZenGRC’s core risk functionality to introduce a powerful new set of risk intelligence tools. The latest additions provide visibility on how multiple risks interact, its potential impact, probability occurrence, and remediation plans. ZenGRC Risk Management helps organizations increase their risk intelligence and evolve towards a proactive risk management strategy.

Here’s what we’ve launched:
We’ve expanded ZenGRC’s Risk Management solution to provide a centralized, fully-customizable platform that will advance your InfoSec Risk program while furthering your organization’s business goals.

These enhancements to ZenGRC enable our customers to have a comprehensive understanding of their organization’s complete risk landscape. With the ability to aggregate risks, ZenGRC provides objective insight and illustrates interconnected risks across the organization.

Notable features:

Pre-loaded Risk Content leverages industry-standard tools and techniques. Risk registers like SCF’s and NIST’s, the Cyber Risk Catalog, and the RISQ Management Enterprise Risk Register facilitate identification and tracking of risk exposure. Incorporating multiple risk assessment methods, like CIS-RAM Simplified and RISQ Simplified, bolsters risk modeling and analytics.

Risk Calculations, customized around the factors most important to your organization, give meaningful insights. Select the attributes to be tracked and assign weights across multiple variables. With customer-defined vectors, you can evaluate the impact, likelihood, and velocity of risks.

Better workflows increase efficiency and turn ad-hoc processes into repeatable workflows, customizable to reflect the nuances of your organization’s operational and business decisions.

Real-time Visibility facilitates tracking, reporting, and required actions on all risk objects. You can visualize overall risks, or drill down into risks accepted, mitigated, shifted, or avoided.

Better Risk Intelligence Creates Value
The new features we’ve released today, and all that is to come in our roadmap, enable ZenGRC to provide the highest level of risk intelligence for our customers. With real-time information, our customers are empowered to make data-backed decisions, resulting in huge cost savings and return on investments.

With our additional enhancements for identifying, assessing, and managing InfoSec risks, ZenGRC delivers more value, provides better visibility, and enables faster decision making.

RECIPROCITY DEBUTS ADVANCED ZENGRC RISK MANAGEMENT

Libby Bevin · February 5, 2020 ·

Provides Powerful Risk Management and Deep Insights Across Enterprise Risk Areas, Business and Information Security Applications, and Third-Party Vendors

SAN FRANCISCO – February 5, 2020 – Reciprocity, the company behind ZenGRC, the industry-leading information security risk and compliance solution, today announced significant enhancements to ZenGRC Risk Management. Building on the ZenGRC core risk functionality, customers now gain a powerful new set of tools in their efforts to evaluate and mitigate risk. In addition to providing insight into how multiple risks interact, how they could impact the business, the probability of occurrence, and actions the company can take to remediate risks, organizations will also get enhanced visibility into risks through the library of pre-built connectors available through Reciprocity’s ZenConnect platform.

ZenGRC Risk Management capabilities include:

Fully Customizable Risk Calculations: establishes relationships across systems, business divisions, and controls to understand the impact to the company risk profile and see the connections holistically; considers the interaction of multiple risks rather than focusing on a single risk or event, and considers the potential impacts of multiple threats
Advanced Risk Workflows: after identification and assessment of a potential risk, automatic remediation options are presented to resolve compliance gaps and strengthen risk posture
Custom Dashboards, Reporting, and Heat Maps: help identify key issues and provides executive-level insights that support leveraging risk intelligence for reward and value creation, rather than risk avoidance
Pre-loaded Content: compatible with existing programs and methods, allowing an easy move from spreadsheets, reduced change management process, and fast time to value

“Reciprocity is committed to listening to our customers and delivering a solution that simplifies complex processes, helps take their risk management program from reactive to proactive, and transforms risk management into a competitive advantage,” said Scott Nash, Vice President of Product at Reciprocity, “With ZenGRC, we’ve delivered a fully customizable risk solution, with integrations to leading business, workflow, and information security apps, getting customers closer to continuous-monitoring and real-time risk statuses across the entire tech stack.”

ZenGRC Risk Management is available immediately across all geographies. ZenGRC helps companies from all vertical markets, particularly those facing strict governance and compliance standards and complex risk management, and has seen rapid growth and adoption across mid-market and enterprise organizations in technology and technology-enabled industries.

ZenGRC provides exceptional value, including the best-in-class time to value and total cost of ownership, with a flexible platform that fits unique program requirements, pre-loaded with content and templates, and white-glove onboarding from our team of industry experts. Current customers can contact their customer success manager, and access educational materials at ZenUniversity. For more information or to schedule a demo, go to www.zengrc.com.

For more information contact:

Kari Curto
press@reciprocity.com
(650) 504-1076