(United States) Apparently, "no one" is ready for the CCPA, California's new privacy law, which took effect on 1st January 2020. The Verge reports as follows:

The California Consumer Privacy Act goes into effect January 1st, and it doesn’t look like anyone, even the state of California itself, is totally ready. Draft regulations for enforcing the law are still being finalized at the state level, and questions about specific aspects of the most sweeping privacy regulation since the European Union’s General Data Protection Regulation (GDPR) are still not clear.

“If you thought the GDPR was bumpy, the CCPA is going to be a real roller coaster,” Reece Hirsch tells The Verge. Hirsch is co-head of Morgan Lewis’ privacy and cybersecurity practice and has been advising clients on how to adapt to the new law. “This is a complex set of new rules, which are still a work in progress.”

The crux of the CCPA is this: if your company buys or sells data on at least 50,000 California residents each year, you have to disclose to those residents what you’re doing with the data, and, they can request you not sell it. Consumers can also request companies bound by the CCPA delete all their personal data. And as The Wall Street Journal reported, websites with third-party tracking are supposed to add a “Do Not Sell My Personal Information” button that if clicked, prohibits the site from sending data about the customer to any third parties, including advertisers.

Despite the handwringing ahead of its deadline last year, the official adoption of GDPR went as smoothly as could be expected. Facebook and Google are already facing billion-dollar lawsuits over alleged violations of the GDPR, but it will be years before those suits are closed. Until that time, small companies will have only a muddled sense of how they might be vulnerable to the rule, and compliance continues to be something of a puzzle.

But the CCPA is likely to be an even greater compliance challenge. It’s the first sweeping legislation in the US to give consumers control over how their personal information is used online, and may signal how other states will seek to protect their residents’ privacy, Hirsch says.

He’s advising clients not only update their privacy policies, but to also create processes for retaining copies of any personal information collected about consumers. Hirsch is also advising companies determine who will respond to and handle consumers’ requests for information and the deletion of that information.

California Attorney General Xavier Becerra said earlier this month that even though widespread enforcement of the CCPA isn’t likely until July, companies should not view the first six months of the year as a grace period. “We’re going to try to help folks understand our interpretation of the law,” Becerra said last week, as quoted by the San Francisco Chronicle. “And once we’ve done those things, our job is to make sure there’s compliance, so we’ll enforce.”

(Privacy press clipping sourced via The Verge)
Jurisdiction: United States

Key takeaways:

• The Verge has reported that compliance levels with the CCPA are wanting, particularly among the smaller and medium-sized enterprises to which the CCPA will apply.

• Serious enforcement of the law will not begin until July, according to what the Attorney General’s office has said. This should not be viewed as a “grace period”, however, with the Attorney General looking to take an educational role ahead of more stringent enforcement measures after July 2020.

• Going from The Verge’s interview with Reece Hirsch, there are key obligations under the CCPA which will be hard to comply with unless companies have established specific protocols and procedures. These include obligations when you want to sell data associated with a consumer, or in honoring a deletion request made by a consumer. Fines under the CCPA can attract US$ 7,500 per violation. Readers should recall however that a single incident may involve many violations of the CCPA, meaning that the actual total applied in a given case may be quite high, easily running into the millions if large numbers of consumers are involved.