As of January 1, 2020, the California Consumer Privacy Act (CCPA) is in effect and impacts numerous businesses that collect or process the personal information of California residents.  The CCPA carries potentially stiff penalties for noncompliance, but the actual text of the law does not provide a clear roadmap for companies to feel comfortable that they are doing things the right way.  As such, we are already seeing dramatic disparities in how companies across the world are interpreting the CCPA and choosing to implement its requirements.  They can’t all be right.

As companies were getting up-to-speed on the effects of the European Union’s General Data Protection Regulation (GDPR) last year, California quickly enacted its own privacy law, the California Consumer Privacy Act (“CCPA” or “Act”) last June. We address below the high risk associated with the CCPA and its interaction with regulations in key U.S. industries. The fast-passed legislation was designed to avoid a November 2018 ballot initiative on the subject, and was plagued by errors and ambiguities that require robust clarification.  The Act’s take-away, however, was abundantly clear – California consumers have a right to know what personal data companies are collecting and are empowered to bring a private right of action for a data breach (and even potentially for other violations of the Act).