The State of California has enacted new privacy laws.
The California Consumer Privacy Act of 2018 will go into
effect beginning January 1, 2020.
The new law will require businesses that collect personal
information on residents in California to meet new stringent
requirements.
These requirements include:
-companies make certain disclosures to consumers via their
privacy policies, or otherwise at the time the personal data
is collected. For example, let consumers know their rights
under the Act;
inform consumers of the categories of personal information
they collect, the purposes for which that personal
information is collected, and the categories of personal
information that it sold or disclosed in the preceding 12
months.
-Inform consumers if you sell their personal information and
give them the opportunity to opt out.
-Do not sell the personal information of consumers younger
than 16 years of age without their consent.
For consumers younger than 13 years of age you must
get their parent or guardian permission.
-Provide at least two means for consumers to submit requests
for disclosure and provide the requested information free of
charge and within 45 days.
-Businesses can offer financial incentives to consumers for
the collection, sale, or deletion of their personal
information, under certain conditions and with appropriate
notification.
This Act will affect businesses that meets any of these
criteria:
-For-Profit businesses that collect and control California
residents’ personal information.
-Do business in the State of California, and:
-(a) have annual gross revenues in excess of $25 million; or
-(b) receive or disclose the personal information of 50,000
or more California residents, households or devices on an
annual basis; or
-(c) derive 50 percent or more of their annual revenues from
selling California residents’ personal information.
The Act also affects
corporate affiliates of businesses that share their
branding.
The Act defines personal information as information that
identifies, relates to, describes, is capable of being
associated with, or could reasonably be linked, directly or
indirectly, with a particular consumer or household.
This includes:
-Record of personal property
-Purchasing information
-Internet activity
-Education information
Penalties for violating the act includes the following:
-Civil penalty for intentional violations of the Act is up
to $7,500 per violation.
-Individual or class lawsuits for statutory or actual
damages ranging from $100 and $750 per California resident
per incident, or actual damages, whichever is greater.
The bottom line is that businesses will incur significant
compliance costs in order to update procedures, policies,
web sites and hiring of staff to meet the requirements of
the new law.
|