California Attorney General Gives Heads-Up on CCPA Rights

Shortly after the January 1, 2020 effective date of the California Consumer Privacy Act (“CCPA”), the California Attorney General’s Office released an Advisory reminding Califorina consumers of their rights under the CCPA. This Advisory provides businesses with insight into items the Attorney General’s Office deems important and on which it is focusing. The Advisory highlights three main areas covered by the CCPA: 1) consumers’ fundamental privacy rights under the CCPA; 2) businesses subject to the CCPA; and 3) the data broker registration requirement.

Notably, the Advisory lists and encourages consumers to know their rights under the CCPA and provides a web address and phone number for consumers to report complaints to the Attorney General. Among the specific rights, the CCPA grants California consumers the right to know, right to delete, the right to opt-out of the sale of their personal information, rights for minors regarding opt-in consent, and the right to non-discrimination regarding personal information. In addition, the Advisory reminds consumers of their private right of action in the event of a data breach.

The Advisory restates the CCPA jurisdictional requirements to identify those subject to the CCPA. For a business to fall within the purview of the CCPA, the business must operate in the state of California and either:

• Have a gross annual revenue in excess of $25 million; or
• Buy, receive, or sell the personal information of 50,000 or more consumers, households, or devices; or
• Derive 50 percent or more of its annual revenues from selling consumers’ personal information.

The draft regulations also indicate that businesses which handle the personal information of more than four (4) million consumers will have additional record-keeping obligations. While these regulations are still subject to change, businesses should anticipate stringent standards and active enforcement regarding the collection and sale of personal information.

Finally, the Advisory highlights the CCPA’s Data Broker Registration requirement and provides a web address for data brokers to register with the Office of the Attorney General. A data broker must pay a registration fee and provide certain information when registering, as required by the CCPA. The data broker registry will be made available to consumers. Failure to do so would likely result in active enforcement and penalties under the CCPA.

For more information on the CCPA, the draft regulations proposed by the Attorney General, and whether your business must comply with the CCPA, please contact Clark Hill’s ASSET360 Group at info@clarkhill.com.