By Joseph M. Mellano of Shustak Reynolds & Partners, P.C. posted on Monday, March 16, 2020.

Joseph M. Mellano

Partner

Location: San Diego
Phone: (619) 696-9500 (Ext. 126)
Direct: (619) 546-9931
Email: [email protected]

The State’s Newest Privacy Law Imposes Strict, New Requirements On Businesses That Collect, Use, or Sell Consumers’ Personal Information. 

The California Consumer Privacy Act (“CCPA”), which took effect on January 1, 2020, significantly changes businesses’ legal obligations in collecting and maintaining consumers’ personal data.

Importantly, the CCPA does not apply to all California businesses. The law applies only to non-governmental, for-profit entities that “[do] business in the State of California” and (a) have gross adjusted annual revenues in excess of $25,000,000; (b) annually buy, sell, or receive personal data of 50,000 or more consumers, households, or devices; or (c) derive more than half of their annual revenue from selling consumers’ personal information.

Insofar as it applies, the CCPA requires businesses to take certain, statutorily-mandated measures to ensure consumers understand how their personal data is being collected and used and allow consumers to opt out of the collection and use of their data. Exactly what measures the CCPA requires any particular business to take depends on the circumstances of that business. Generally speaking, however, the CCPA requires businesses to (1) inform consumers of the types of personal data they collect about them at or before the point of collection, (2) afford consumers the right to request disclosure of all personal data collected about them, (3) advise consumers they have a right to request the deletion of any or all personal data collected and observe consumers’ exercise of that right, (4) advise consumers they have a right to opt out of the sale of their personal data and observe consumers’ exercise of that right, and (5) not discriminate against consumers because they exercise any of the foregoing rights, e.g., by denying them goods or services or charging them higher prices or rates.

Violation of the CCPA subjects businesses to serious risk of civil litigation and penalties. The CCPA specifically authorizes consumers to bring lawsuits against violating businesses for statutory damages, injunctive relief, and other appropriate relief. The law similarly authorizes the California Attorney General to prosecute violating businesses by filing actions against them for injunctive relief and civil penalties in state court. Statutory damages and civil penalties under the CCPA can be substantial. So too can the costs of having to comply with an injunction.

The CCPA is complex and tremendously consequential for many businesses. Principals of businesses subject to it should consult with legal counsel about how to implement its many requirements.

Shustak Reynolds & Partners, P.C. focuses its practice on securities and financial services law and complex business disputes. 
We represent many broker-dealers, registered representatives, investment advisors, investors and businesses. 
To speak with an attorney, contact us at (619) 696-9500.

Share This Article