The California Consumer Protection Act (CCPA): What You Need to Know and Do to Manage Your Brand Risk

Privacy: It’s becoming a much bigger presence within business data in 2020 and will only increase. California has taken the lead for what will surely follow. Keeping current with legislation will help position data-driven businesses for compliance, adaptation and opportunity.

Today’s consumers have grown accustomed to reports of massive data breaches, the widespread sharing and selling of their information, and tsunamis of e-mail marketing they may not have asked for. This in turn has made them more determined to reconstruct the boundaries surrounding their privacy.

In 2016, the European Parliament and Council passed the General Data Protection Regulation (GDPR) as a primary law to regulate how companies protect EU citizens’ personal data; the law went into effect in May 2018.

The tide is now turning stateside as well. As of January 2020, the California Consumer Privacy Act (CCPA) is in effect, and enforcement will begin July 1. Other states, including Vermont and South Carolina, are already expected to follow.

For companies that use, manage and analyze data, having a current plan and platform for consumer consent and preferences will rapidly change from optional to necessary. As we prepare to adapt to the new statutes, let’s look at the basics of the CCPA we should know.

What It Is
The CCPA aims to enhance California residents’ privacy rights and consumer protection pertaining to businesses’ access to, deletion of and sharing of personal data. Monitored by the state attorney general, it requires that California consumers be able to:

• know about all of the personal data being collected about them and have access to it
• be aware of all personal data that is being sold or disclosed and to whom it is sent
• deny a business’s sharing of their personal data
• request that a business delete any personal information that has been collected about them
• not be discriminated against for exercising their privacy rights.

The CCPA also includes provisions for fines and even for further litigation from consumers.

Who’s Affected
The CCPA applies to businesses that collect personal data of California residents and meet at least one of the following criteria:

• generate an annual gross revenue of $25 million or more
• buy, use, sell or share personal information belonging to at least 50,000 consumers, households or devices in California
• earn at least half their annual revenue from selling consumers’ personal information

A few examples of the industries that will be impacted by the legislation include:

• Retail
• Insurance
• Marketing and Advertising Agencies
• Media
• Travel and Hospitality
• Gaming and Entertainment
• Banking/Financial Services
• Telecommunications

Are out-of-state businesses still subject to the CCPA?  Yes, if they meet the above criteria and if they hold, collect, share or sell the personal information of any California resident. The same applies to businesses that aren’t within the U.S.

What to Do and Consider Right Now
The shifting privacy climate will call for prompt responses and highly focused attention nationwide. To both safeguard our businesses and maintain good customer relationships, we’ll need to adjust how we think about consumer consent and privacy.

We’ll have to better manage consumer requests and desires; carefully document data collection, processing and storage; regularly monitor and assess our exposure to risk; and prepare even further ahead for the possibility of responding to data-related events. We’ll also need to keep current with the varying levels of legislation being considered in other states in 2020.

If your business will be affected by the CCPA, now is a good time to begin:

• ensuring full understanding of your privacy-policy practices, as well as consumer- choice options, by stating them in clear, simple language where your customers can easily find it
• requiring affirmative express consent before collecting and using customer data
• providing customer contact choices such as when, how and for what customers will receive marketing information from you
• establishing a scalable customer-focused privacy response with components such as a standardized policy that all personnel can consistently follow and use (e.g., in a script or a clear outline); a proactive plan for handling special situations such as a power of attorney; and how to verify consumer identities provided by third-party data sources.

Whom to Have on Your Side
Some companies’ data systems are vast and complex. Other businesses simply may not have the privacy knowledge and resources with the experience to adapt and comply in the new environment.

In addition to having in-house consumer-privacy plans and procedures, partnering with specialists in consent and preference management can help you to quickly navigate and minimize the risk of integrating and organizing information.

The right support can enable your business to thrive even when it gets all too overwhelming.

An ideal partner assisting in navigating your business plans should:

• have depth of experience with handling consumer data and digital marketing
• have a customizable software platform created by preference-management experts
• provide simple, non-disruptive integration with your current system at a fair price point
• fast-track your ability to manage and respond to consumer rights.

Equally important, your partner should have an interest in enhancing your brand and your business viability. For businesses that collect and store data, the world really is starting to change.

Allant: Here When You Need Us
The CCPA gives us all plenty to think about. The good news is that Allant has already done the research to help you meet this challenge quickly and effectively (learn more). If you have any questions or concerns about the CCPA or integrating consent and preference management into your marketing efforts, simply contact us at (800) 367-7311 to speak with a specialist.