CCPA Enforcement: What You Need to Know

If you want to do business in California, the 5th largest economy in the world (soon going to become the 4th), you will have to comply with the California Consumer Privacy Act strictly. This new law gives consumers full rights to decide how they want their personal data to be collected, stored, used, and sold. Businesses, irrespective of their geographical location, must abide by the consumers’ choices. Any form of violation, whether intentional or unintentional, can invite financial penalties and statutory damages. California’s Attorney general directly deals with CCPA enforcement and ensures that consumers aren’t discriminated against in any way based on their privacy choices.

This article is intended to help you understand the importance of CCPA enforcement, penalties for failure/ignorance, and how you can make your business CCPA-compliant. To learn more, please read our other helpful articles on CCPA, CCPA Versus GDPR, CCPA certification procedure, etc.

CCPA Enforcement – Are you eligible?

If you are a business that collects, shares, or sells personal data of California residents and meets any of the criteria mentioned below, you are required to adhere to CCPA guidelines.

The criteria are:

• Your annual gross revenue is more than $25,000,000
• You collect, buy, sell, or share the personal information of more than 50,000 California residents, households, or devices.
• You earn more than 50% of your annual revenue by selling the personal information of the consumers.

CCPA applies to businesses across the world. It also applies to nonprofit companies that fit the description of business stated in section 1798.140 (c) (2) of the CCPA.

According to CCPA, your consumer isn’t just the person you sell your products or services to. It refers to anyone (and any household or device) whose data you are collecting, whether you are doing business with them or not. They could also be your job applicants because they have shared their personal data with you. CCPA covers every California resident, whether or not they are currently located in California.

What can get you penalized for CCPA violation?

You may invite penalty if:

• You fail to maintain a CCPA-compliant privacy policy
• You fail to inform your consumers while collecting their personal information
• You sell/share/disclose/rent the personal information of people even when they have opted-out
• You fail to adequately respond to consumers’ requests covered under CCPA
• You discriminate against people who opt out of sharing/selling their personal data

All these violations may invite a penalty even when done unintentionally.

What are the potential penalties for CCPA violations?

Notice and Cure Period

During these 30 days, they may rectify the violations. They may then inform the Attorney General and the affected consumers that the issues have been fixed. This can help them avoid legal action, but the Attorney General’s decision will be final.

Although this sounds like a relief, the 30-day period may not be enough to fix those issues, especially if it has happened due to data breaches where a person’s identity may have been used for committing crimes or for identity thefts.

Penalties

Now, $7,500 is nothing for multi-billion dollar businesses such as Facebook or Google. But there is a catch here. The penalty is per violation, i.e., per consumer. So, if you failed to protect the data of 1000 consumers during a data breach, you may have to pay $2,500 X 1000 or $7,500 X 1000.

Besides the penalties mentioned above, you may also have to pay $100 to $750 to each customer as injunctive relief, should they ask for it. If the actual damages are higher, you may have to pay even more.

Who is responsible for enforcing the CCPA?

CCAP also gives a ‘private right of action’ to consumers. People can ask for statutory damages ranging between $100 and $750 for the inconvenience caused to them. If they have suffered any damage whose actual value is more than $750, they can ask for actual damage. In this case, the Attorney General’s decision will be final.

How can businesses ensure compliance with the CCPA

Here are a few things you can do:

• Update your privacy policies to meet CCPA’s requirements. Mention what data you are collecting, how you are collecting the data, and what you intend to do with that. Keep refreshing your privacy policies annually to ensure compliance.
• Notify your consumers about their opt-out rights in case they do not want their personal data to be collected for use, whatsoever purpose it may be. The opt-out option should be clearly displayed on the website.
• Start data mapping, so you can quickly and correctly honor customer requests. Collect and carefully segregate only the information that you need.
• Train your staff to quickly and efficiently address customer requests. Inform them about the importance of CCPA and why they must communicate clearly with the consumers.
• Make your business ISO 27001 compliant so that you can prevent data breaches.

For more details on how to become CCPA compliant, you can read this article.

Wrap up