CCPA

The California Consumer Privacy Act (CCPA), the United States’s strictest and most comprehensive data privacy law, has the broadest definition of “personal information” of any law in effect—including the European Union’s General Data Protection Regulation (GDPR). The law is so sweeping that it includes 11 categories of personal information.

The CCPA aims to prevent the sale or sharing of California residents’ (“consumers”) personal information without their permission—but it protects more than the conventional types of “personal data” such as name, telephone number, and social security number. The law considers a person’s browsing and search history, geolocation data, biometrics, and other types of information that has not been “de-identified” to be worthy of regulation, as well. 

What is Personal Information Under CCPA?

The CCPA defines “personal information” as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” 

It establishes the following categories of personal information: 

1. Identifiers: Name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers
2. Customer records information: Name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit or debit card number, other financial information, medical information, health insurance information
3. Characteristics of protected classifications under California or federal law: Race, religion, sexual orientation, gender identity, gender expression, age
4. Commercial information: Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
5. Biometric information: Hair color, eye color, fingerprints, height, retina scans, facial recognition, voice, and other biometric data
6. Internet or other electronic network activity information: Browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement
7. Geolocation data
8. Audio, electronic, visual, thermal, olfactory, or similar information
9. Professional or employment-related information
10. Education information: Information that is not “publicly available personally identifiable information” as defined in the California Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99)
11. Inferences

The law also includes inferences that could be used to create a profile reflecting a consumer’s: 

• Preferences
• Characteristics
• Psychological trends
• Predispositions
• Behavior
• Attitudes
• Intelligence
• Abilities
• Aptitudes

It gives the California attorney general the power to add categories of personal information to address changes in technology, data collection practices, obstacles to implementation, and privacy concerns.

What is not considered personal information?

Personal information, also known as personally identifiable information (PII), refers to any data that can be used to identify a specific individual. Understanding what is not considered personal information can be just as important, especially in the context of privacy and data protection. Here are some examples of data typically not considered personal information:

1. Aggregated Data: Information that has been compiled into data summaries, usually for the purposes of public reporting or statistical analysis. For example, a report stating that “60% of users prefer online shopping” does not contain personal information.
2. Anonymized Data: This is data from which personal identifiers have been removed. If the process of anonymization is done properly, it should be impossible to link the data back to any individual.
3. Public Information: Data that is already publicly available and can be accessed by anyone. For example, a published article or a phone number listed in a public directory.
4. General Information: Information that is too broad or common to identify a specific individual, such as a first name without any additional context or demographic information.
5. Business Contact Information: In some jurisdictions, the contact information used for business purposes (such as business phone number, address, or email) is not considered personal, especially when it’s used solely in a professional context.
6. Random Data: Data that does not relate to or describe an individual, such as random alphanumeric sequences that are not linked to personal identifiers.

It’s important to note that the classification of information as personal or non-personal can depend on the context and the jurisdiction. For instance, in some cases, even seemingly non-personal information can become personal if it’s combined with other data that makes the individual identifiable.

Why the categories matter?

The CCPA establishes new consumer rights regarding personal information. Under the law, businesses that collect personal information from consumers must inform them at or before the time of collection that they are doing so. Businesses must disclose the categories of information they are collecting and the purpose for which it will be used.

Those businesses must also provide a “Do Not Sell My Personal Information” button or link on their website’s home page.

If it receives a verifiable consumer request, a business must respond with:

• Which categories of personal information it has collected about the consumer
• The categories of sources of that information 
• Its business or commercial purpose for collecting or selling it
• Which categories of third parties, such as service providers, with which it shares personal information
• Specific pieces of personal information the business has collected about the consumer

When selling a consumer’s personal information or disclosing it for a business purpose, a business must disclose, upon request: 

• The categories of personal information the business has collected about the consumer
• The categories of the consumer’s personal information the business has sold and the categories of third parties to which it sold the data 
• Which categories of the consumer’s personal information the business has disclosed for a business purpose

Characteristics of Personal Data under the CCPA

The California Consumer Privacy Act (CCPA) is a comprehensive data privacy law that came into effect in California on January 1, 2020. It provides California residents with certain rights regarding their personal information held by businesses. Under the CCPA, personal data is defined with specific characteristics:

1. Identifiability: Personal information under the CCPA includes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. This broad definition ensures that a wide range of data types can be considered personal information.

2. Types of Information Included:

• • Identifiers: This includes direct personal identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.
  • Characteristics of Protected Classifications: Information related to characteristics of protected classifications under California or federal law, like race, religion, sexual orientation, gender identity, etc.
  • Commercial Information: Including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
  • Biometric Information: Data generated from physical characteristics or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints, and voiceprints.
  • Internet or Other Electronic Network Activity Information: Such as browsing history, search history, and information regarding a consumer’s interaction with a website, application, or advertisement.
  • Geolocation Data: Precise geographic location information about a particular individual or device.
  • Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information: Essentially, any sensory data related to a consumer.
  • Employment-related Information: Professional or employment-related information.
  • Education Information: Information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (FERPA).
  • Inferences Drawn from Personal Information: To create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

3. Exclusions: Publicly available information is not regarded as personal information under the CCPA. Publicly available means information that is lawfully made available from federal, state, or local government records.

4. Context-Dependent: The classification of data as personal information under the CCPA can depend on the context in which the data is used. If the data can be used to reasonably identify, relate to, describe, be associated with, or impact an individual or household, it’s likely to be considered personal data.

The CCPA’s definition of personal information is broad and inclusive, reflecting a growing trend in privacy laws to provide comprehensive protections for consumer data. Businesses subject to the CCPA must understand these definitions to ensure compliance with the law’s requirements.

Who Must Comply with CCPA?

The California Consumer Privacy Act (CCPA) applies to a specific set of businesses, regardless of their location, as long as they handle the personal data of California residents. The criteria for businesses that need to comply with the CCPA are as follows:

1. Annual Gross Revenues: Businesses with annual gross revenues in excess of $25 million.
2. Volume of Data: Companies that buy, receive, sell, or share for commercial purposes, the personal information of 50,000 or more California residents, households, or devices annually.
3. Income from Selling Data: Businesses that derive 50% or more of their annual revenues from selling California residents’ personal information.

It is important to note that these criteria apply to businesses operating within California as well as those located outside California if they meet the above criteria in their dealings with California residents.

How Can My Company Comply with the CCPA?

Complying with the CCPA involves several steps to ensure that your business respects the privacy rights of California residents and adheres to the regulations. Here’s a guideline for compliance:

1. Understand the Data You Collect: Identify the types of personal information your company collects, where it’s sourced from, how it’s used, and with whom it’s shared.
2. Update Privacy Policies: Your privacy policy should reflect CCPA requirements. This includes informing consumers about their rights under the CCPA, the categories of personal information collected, the purposes for which the information is used, and the categories of third parties with whom the information is shared.
3. Create Consumer Request Processes: Establish procedures to respond to consumer requests. Under CCPA, consumers have the right to know about, access, and delete their personal information, as well as the right to opt-out of the sale of their personal information.
4. Implement Opt-Out Methods: Provide a clear and conspicuous “Do Not Sell My Personal Information” link on your website’s homepage, allowing consumers to opt-out of the sale of their personal information.
5. Train Employees: Ensure that all employees handling consumer inquiries or responsible for CCPA compliance are well-trained and aware of the procedures and timelines for handling consumer rights requests.
6. Data Security Measures: Implement reasonable security measures to protect the collected personal information from unauthorized access, destruction, or disclosure.
7. Vendor Management: If you share personal information with service providers or third parties, ensure that they are also complying with CCPA requirements.
8. Regular Compliance Audits: Regularly review and audit your data practices, privacy policies, and compliance processes to ensure ongoing adherence to CCPA standards.
9. Prepare for Consumer Requests: Have a system in place to efficiently handle and respond to consumer requests within the CCPA’s specified timelines (45 days, extendable by another 45 days).
10. Record-Keeping: Maintain records of consumer requests and how they were responded to for at least 24 months as required by the CCPA.

By diligently following these steps, companies can ensure they are in compliance with the CCPA, thereby protecting the privacy rights of California residents and avoiding potential penalties.

FAQs for CCPA

What is an Example of Personal Information Under the CCPA?

Under the California Consumer Privacy Act (CCPA), personal information is defined broadly to include any information that identifies, relates to, or could reasonably be linked with a specific individual or household. An example of personal information under the CCPA would be:

Detailed Example: John Doe, a resident of California, subscribes to an online shopping platform. The personal information collected by this platform about John could include his full name, home address, email address, phone number, credit card details, browsing history on the platform, purchase history, and geolocation data from his mobile device. The platform may also collect inferences drawn from this data to create a profile about John’s preferences and behavior.

All this data falls under the scope of personal information as defined by the CCPA.

This example illustrates how a range of identifiable data, including digital footprints and inferred profiles, is considered personal information under the CCPA.

What is a CCPA Notice at Collection of Personal Information?

A CCPA Notice at Collection of Personal Information is a disclosure requirement mandated by the CCPA. This notice must be provided to consumers at or before the point of collecting their personal information. The notice should include:

• Categories of Personal Information Collected: The notice must clearly list the categories of personal information that the business intends to collect.
• Purpose of Collection: The business must specify the purposes for which the collected personal information will be used.
• Information on Selling or Sharing: If the business sells or shares personal information, the notice must include this fact and provide information on how consumers can opt-out.
• Link to Privacy Policy: The notice should include a link to the business’s privacy policy, where consumers can get more detailed information about data handling practices.

The CCPA Notice at Collection serves to inform consumers upfront about what personal information is being collected and why, enhancing transparency and giving consumers a chance to make informed decisions.

What Categories of Personal and Private Information Can be Gathered?

Under the CCPA, a wide range of personal and private information can be gathered. These categories include, but are not limited to:

1. Identifiers: Such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.
2. Characteristics of Protected Classifications: Including age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information.
3. Commercial Information: Including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
4. Biometric Information: Data generated from physical characteristics or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints, and voiceprints.
5. Internet or Other Electronic Network Activity Information: Such as browsing history, search history, and information regarding a consumer’s interaction with a website, application, or advertisement.
6. Geolocation Data: Precise geographic location information about a particular individual or device.
7. Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information: Including images and audio, video or call recordings created in connection with a business’s activities.
8. Professional or Employment-Related Information: Including current or past job history or performance evaluations.
9. Education Information: Non-publicly available education information, like grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.
10. Inferences Drawn from Personal Information: Creating a profile about a consumer reflecting their preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

These categories highlight the breadth of information considered personal under the CCPA, emphasizing the need for businesses to be meticulous in their data collection and handling practices.

Rely on ZenGRC for CCPA Compliance

Relying on ZenGRC for CCPA compliance offers businesses a streamlined and efficient way to manage their privacy obligations. As a comprehensive governance, risk management, and compliance (GRC) solution, ZenGRC simplifies the complex process of adhering to the stringent requirements of the California Consumer Privacy Act (CCPA). It provides an intuitive platform for tracking and reporting on data protection practices, ensuring that all personal information is handled in compliance with CCPA regulations. With features like automated risk assessments and real-time compliance monitoring, ZenGRC helps businesses stay ahead of potential compliance issues. This proactive approach not only minimizes the risk of non-compliance but also instills confidence in customers that their personal data is being managed responsibly.

The California Consumer Privacy Act (CCPA) can be expensive to break, with several ways that regulators and the public can bring actions seeking financial damages against a company that has violated the law’s terms.

The CCPA is the nation’s most stringent data privacy law, designed to protect California residents’ control over their personal information. The CCPA applies to for-profit businesses that collect personal information from California residents and meet other specific criteria, such as having at least $25 million in annual revenue.

How Does the CCPA Work?

The CCPA is similar to the European Union’s General Data Protection Regulation (GDPR) in that both laws give consumers certain rights over how their personal data is used. Unlike the GDPR, however, the CCPA grants consumers the right to sue a company that mishandles their data. In addition, consumers may qualify for statutory damages if they can show that the breach occurred because of a lack of “reasonable security procedures” such as encryption or redacting identifying data.

Many of the CCPA’s details govern how companies acquire and share personal information gathered through websites or other digital techniques. For example, consumers can contact a company and demand to see whatever personal information the company has collected about them. The company must then comply and share that information (with several narrow exceptions, such as data involved in law enforcement investigations).

The CCPA mandates that businesses to respond to user requests for:

• All consumer data captured and saved;
• Each type of personal data (for example, financial, medical, or contact data);
• The commercial reason for gathering and selling user data;
• A list of third-party entities with access to the user’s data.

Businesses must also be ready to respond to the following user requests:

• That the user’s data be removed;
• That the user’s data not be shared or resold to others;
• That the user receives the same treatment as other customers, even when the user forbids data sharing;
• That the data be transferred to another entity.

What Counts as a CCPA Violation?

Section 1798.155 of the CCPA states that any business, service provider, or individual that breaches the CCPA’s terms and conditions shall face fines and penalties based on a “private right of action” – meaning, the aggrieved consumer can take the company to civil court directly, rather than wait for the state attorney general or other prosecutors to act.

Under California law, the damages for CCPA violations may include the following:

• $100 to $750 per consumer per incident, or actual damages, whichever is greater;
• Injunctive or declaratory relief;
• Any other relief the court deems proper.

When assessing damages, the CCPA directs a court to consider the following:

• The nature, seriousness, and persistence of the misconduct;
• The number of violations;
• The length of time over which the misconduct occurred;
• Whether it was an intentional violation;
• The defendant’s assets, liabilities, and net worth.

The law gives businesses a chance to right any wrongs before paying. For example, if a consumer files a complaint against the organization that was breached, the accused company has 30 days to take corrective action before the lawsuit can progress. This notification, however, is optional if the consumer has suffered financially because of the breach.

What Are the Penalties for CCPA Violation?

Even if no breach has happened, the California Attorney General (AG) can prosecute a business for general violations of the CCPA. Examples include a business’s failure to respond to consumer requests to view or delete personal information or the unauthorized sale of their personal information (or sharing of that data).

The attorney general, too, must give business 30 days to come into CCPA compliance. If a company does not rectify any problems during that time, the attorney general may impose a civil penalty of up to $2,500 per violation (that is, even an accidental violation) or $7,500 for each intentional violation.

The Cost of CCPA Noncompliance

But fines could become the least of your problems if you become non-compliant with CCPA, as there are more prominent and costlier consequences for violating this regulation:

Injunctions

If a company fails to correct its alleged violations during the cure period, it will face injunction and civil sanctions. An injunction indicates a court order compels the company to stop engaging in specific actions.

The CCPA does not specify what an injunction would entail. Nonetheless, it may force the company to halt operations (or, at the very least, stop collecting and processing consumers’ personal information) until it becomes CCPA-compliant. 

Private Right of Action

Under Section 1798.150 of the legislation, the CCPA creates a private right of action. That is, it allows California residents to sue companies that fail to follow the security regulations outlined in Section 1798.81.5. 

According to the CCPA’s private right of action, a Californian may seek either statutory damages ranging from $100 to $750 per consumer per incident or actual damages (i.e., the substantial losses suffered by the consumer as a result of the breach), whichever is greater.

Impact on Customer Relationships

In addition to disputes, organizations that fail to comply with CCPA standards may damage consumer relationships. Consumers have become more aware of their rights due to GDPR and the increasing number of documented data breaches. They also have higher expectations of businesses in terms of data privacy.

A data privacy study from IBM and The Harris Poll found that 65 percent of consumers consider a company’s data security practices when deciding whether to do business with them. Companies that fail to secure personal data risk losing customers and the money and insights they provide.

How to Avoid CCPA Fines

To avoid CCPA penalties, here are a few best practices:

• Assess and examine your activities thoroughly. Consider the data you gather, the reasons for your collection, the third parties engaged in the processing, and so on. This assessment will assist you in determining which legal papers you may require and how to handle user requests.
• Establish a transparent privacy policy that includes all pertinent disclosures about how you gather and use consumers’ personal data. It should be simple to find on the home page of your website or mobile application, explain the procedure via which users can ask for modifications to their personal data, and display your contact details in case of CCPA requests;
• Ensure you respect the user’s choice not to have their personal information sold or shared. While the CCPA does not need users’ opt-in or prior authorization before sharing or selling personal data, you are still required to notify them of the sale activity and give them a quick means to opt out. You must display a “Do Not Sell My Personal Information” (DNSMPI) alert to users when they first access your app or website.

Compliance Management With ZenGRC

Reciprocity ZenGRC, a compliance and audit management system, provides a quicker, simpler, and smarter way to compliance by reducing time-consuming manual procedures, expediting onboarding, and keeping you informed about the status and performance of your programs.

Optimize your teams’ skills by freeing them from manual tasks and allowing them more time to create great results. The ZenGRC platform generates connections and corresponding work assignments automatically. In addition, evidence requests may be entirely automated using pre-built connectors and APIs, reducing tedious labor and expediting the process.

Reciprocity ZenGRC provides the visibility you need to analyze the progress and success of your compliance activities and their influence on risk reduction. An audit overview report summarizes the frameworks, requirements, and controls in scope, the activities to be done, and the present audit status.

ZenGRC removes ambiguity and gets you up and running quickly, allowing you to arrive at your first audit conclusion and achieve immediate gains.

Schedule a Demo today and start the path to worry-free compliance!

The California Consumer Privacy Act (CCPA) applies to certain for-profit businesses that collect or have collected the personal information of California residents, whether or not those businesses are located in California.

Often compared to the European Union’s General Data Protection Regulation (GDPR), the CCPA is the most stringent data privacy law in the United States. And in fact, its reach is nearly as broad as the GDPR. There is no federal law like the GDPR protecting consumer information. Some states have data privacy laws, but none as stringent as this new California law.

What is CCPA?

The California Consumer Privacy Act (CCPA), effective from January 1, 2020, marks a significant milestone in U.S. privacy law. Targeting for-profit entities with considerable annual gross revenue, it governs how businesses handle personal data, including sensitive information like social security numbers and biometric data, of California residents. This groundbreaking legislation grants California residents enhanced rights over their data, compelling businesses to align with strict privacy protection and cybersecurity standards.

Amendments such as the California Privacy Rights Act (CPRA) further refine this landscape. The CCPA and CPRA collectively strengthen consumer rights, emphasizing transparency in handling consumer data and providing avenues for residents to opt out of selling their personal information. These laws also establish non-discrimination policies for consumers exercising their privacy rights and require businesses to respond effectively to consumer requests.

Businesses face significant legal and financial repercussions for non-compliance, including statutory damages for data breaches and penalties enforced by the California Attorney General. The CCPA’s reach extends beyond California, affecting any legal entity dealing with California residents’ data, thereby setting a precedent for privacy laws nationwide.

Who is protected under the CCPA?

Under the CCPA, “consumers” are defined as natural persons who are residents of California. This broad definition includes a variety of personal data categories, such as IP (Internet Protocol) addresses, geolocation data, and biometric information. The CCPA applies regardless of the business’s location, extending its influence beyond California.

These protections are integral to the CCPA’s goal of enhancing consumer rights and privacy protection. Service providers and businesses, particularly those under common branding, must comply with the CCPA requirements. These include responding to consumer requests about their data, implementing the “Do Not Sell My Personal Information” option on their websites, and maintaining reasonable security practices to prevent data breaches.

The CCPA compliance framework establishes new standards in data privacy, akin to the General Data Protection Regulation (GDPR) of the European Union. For California residents, this means enhanced control over their data, including sensitive information like driver’s license numbers and health data protected under the Health Insurance Portability and Accountability Act (HIPAA). This comprehensive approach places the CCPA at the forefront of privacy law in the United States.

Who is excluded from CCPA?

While the CCPA represents a significant step in data privacy for California residents, it’s essential to understand which entities are not bound by its provisions. Here’s a brief overview:

1. Scope of CCPA: The CCPA primarily focuses on for-profit businesses handling the personal data of California residents, with criteria based on annual gross revenue and consumer data volume. Non-profits and smaller businesses are generally not covered.
2. Exemptions in CCPA: Certain types of information, especially those protected under other privacy laws like the Gramm-Leach-Bliley Act, are exempt from the CCPA. This includes specific publicly available or regulated medical and financial data.
3. Business Requirements under CCPA: While covered businesses are required to comply with CCPA’s mandates, such as providing privacy notices, entities engaged solely in commercial activities with limited consumer interaction may not be entirely subject to all CCPA regulations.

How does CCPA affect consumers?

The CCPA marks a transformative shift in data privacy, greatly amplifying consumers’ rights and control over their personal data. Under the CCPA, California residents gain the right to inquire and receive full disclosure from businesses about the specific types of personal information being collected, the purposes for which it is used, and with whom it is shared or sold. 

The CCPA empowers consumers to take decisive action regarding their data. This includes the right to request the deletion of the personal information held by businesses – a significant step toward personal data autonomy. Additionally, it offers the option to opt out of the sale of their information, providing a tangible way for consumers to control the commercial use of their data.

This legislative shift under the CCPA enhances transparency and fortifies consumer rights in the digital age. It establishes a new benchmark in privacy rights, signaling a broader movement towards empowering individuals in how their personal data is managed and utilized.

What are the penalties for violating CCPA?

There are significant penalties for CCPA violations, particularly for businesses with substantial annual revenue. These entities face civil penalties of up to $7,500 for each intentional violation and $2,500 for each unintentional violation if the issue is not resolved within 30 days of notification. This fine structure is especially pertinent for businesses that handle large categories of personal information, including sensitive data like IP addresses.

Moreover, the CCPA grants consumers a private right of action in the event of a data breach. Consumers can individually sue businesses for statutory damages ranging from $100 to $750 per incident or for actual damages, whichever is higher. Such private lawsuits can be based on incidents like unauthorized access to a consumer’s personal information, underscoring the importance of maintaining functionality and security on business homepages and data systems.

These stringent penalties emphasize the critical need for CCPA compliance, especially for commercial purposes. They highlight the CCPA’s commitment to safeguarding consumers’ personal information and reinforcing their CCPA rights, such as the right to opt out of the sale of their personal information.

Navigate and comply with data protection regulations using ZenGRC

ZenGRC offers tools that simplify the management of consumers’ personal information and ensure compliance with CCPA requirements. The platform’s robust functionality not only aids in avoiding potential penalties but also ensures that your business practices align with the highest data privacy and protection standards.

Partner with ZenGRC to transform the way your business approaches data privacy compliance. Schedule a demo today!