On July 1, 2021, the California Consumer Privacy Act (“CCPA”) imposes a deadline on businesses that buy, receive, sell and/or share for commercial purposes the personal information of 10,000,000 or more California residents in a calendar year. Originally, the CCPA regulations had established a threshold of 4,000,000 consumers. The California Attorney General’s Office increased the threshold to 10,000,000 consumers (which is approximately twenty-five (25) percent of California’s entire population) after receiving feedback during public comment that the 4,000,000 threshold would inflict a substantial burden on small businesses. In the eyes of the California State Attorney General, the CCPA reporting requirement satisfies two goals: 1) It imposes regulations on large businesses most in need of oversight; and 2) it provides consumers with more transparency on how businesses acquire, maintain and/or sell their personal information.
What are the CCPA Reporting Requirements?
- The number of “requests to know” that the business received, complied with in whole or in part, and denied;
- The number of “requests to delete” that the business received, complied with in whole or in part, and denied;
- The number of requests to opt-out that the business received, complied with in whole or in part, and denied; and
- The median or mean number of days within which the business substantively responds to requests to know, requests to delete, and requests to opt-out.
Additionally, the CCPA reporting requirement directs each such business to “establish, document, and comply with a training policy” in order to confirm that the business is educating its employees on CCPA policies and complying with all CCPA regulations. If it is easier for a business, it may decide to disclose information received from all individuals, rather than requests received just from consumers.
Consumer Data Privacy Laws
As we have previous blogged, the CCPA is only one of a handful of states (including Virginia, Nevada and Colorado (awaiting Governor signature)) that have passed consumer data privacy legislation. Until the federal government enacts legislation that will provide businesses with a more uniform set of rules, businesses will have to monitor state consumer data privacy law developments and be aware of upcoming deadlines.
The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.