Questions Linger Over Enforcement of the California Consumer Privacy Act

By: William Kingwell Bliss

Businesses are beginning to comply with the California Consumer Privacy Act (CCPA), even though it won’t be fully enforced until July 2020. The CCPA is intended to provide California consumers more protection and control over their data, but some professors and advocacy groups are concerned it may not be as strong as it seems.

Under the CCPA, Californians have the right to know what data is collected from them, to have their data deleted upon request, and to opt-out of the sale of their data to third parties. However, not every business needs to comply with the law. Companies are subject to the requirements of the law only if they operate in California and have either $25 million in revenue, collect data from at least 50,000 California residents or devices owned by residents, or make 50 percent of their income from the collection of data.

“We are not a small state. It’s a pretty big market to lose access to if you don’t want to comply, or the liability is quite significant if you do business and don’t comply,” said Mike Shapiro, Chief Privacy Officer of the Santa Clara County Privacy Office.

While the law gives consumers the right to bring class action lawsuits in the event of a breach, violations of the CCPA will be enforced by the state’s Attorney General. If found in breach, businesses will have 30 days to bring themselves back into compliance. Otherwise, they may be on the hook for fines of $2,500 per violation, or $7,500 per intentional violation.  

“The problem, from the business perspective, is that they might have 50 different privacy regimes to comply with,” said Shapiro. 

Shapiro said the United States privacy regulation can best be described as a “patchwork” since there is no federal privacy law and every state has its own laws.

“From the advocate’s perspective, you would want your consumers or constituents to be treated fairly in Arkansas, Massachusetts, or Texas, and not have to figure out a different approach for each state,” said Shapiro.

Shapiro pointed out that other states are passing laws similar to the CCPA.

“What happens in California suggests what will happen in the future, and we’ve seen that in other state legislatures which have passed bills since the CCPA has passed,” said Shapiro. 

However, Lydia de la Torre, privacy law fellow and co-Director of the Data Privacy Certificate program at Santa Clara University School of Law, said she sees the CCPA as the first step toward a national privacy framework. 

“The more states act, the more pressure [Washington] D.C. will feel in terms of harmonizing those regulations. Because that is what happened in Europe,” said de la Torre. 

In May 2018, the European Union passed the General Data Protection Regulation (GDPR), a sweeping privacy law which, among other things, required websites to disclose that they use cookies and collect data.

Comparing the CCPA to the GDPR, de la Torre said, “What we’ve seen so far is a little bit of a copy-paste from Europe, but it’s not an easy transplant into the U.S. because our constitutional values are set differently, we treat speech differently because of the First Amendment. The U.S. should look to Europe, learn, but ultimately enact something that fits within the U.S. framework, and address the concerns for the U.S.”

Enforcement is being delayed until July 2020 because the Attorney General’s office is currently working to finalize the regulations. The second round of draft regulations was released on February 10 and the comment period just closed on February 25. Nobody is quite certain when the final regulations will be complete, nor what enforcement will look like come July, but the California Attorney General Xavier Becerra has said that the effort companies take to comply would factor in to how his office would handle possible infringements.

Becerra told Reuters in December, “Given that we are an agency with limited resources, we will look kindly on those (companies) that demonstrate an effort to comply.” But if they do not, he will “descend upon them and make an example of them.”

(Editor's Note: This article was originally published in the March 2020 [Volume 50, Issue 3] version of The Advocate.)