This is the second article in a two-part series discussing readiness steps organizations should consider when implementing the California Consumer Privacy Act of 2018 (CCPA). As we previously discussed, CCPA establishes a new privacy framework for “covered businesses” that fall within its jurisdiction by:
- Creating an expanded definition of “personal information”;
- Creating new data privacy rights for California consumers, including rights to know, access, delete, and opt out of the “sale” of their personal information;
- Imposing special rules for the collection and sale of personal information directly from minors; and
- Creating a new statutory damages framework for violators that fail to implement and maintain reasonable security procedures and practices to prevent data security breaches.
A “covered business” refers to businesses described in Cal. Civ. Code Section 1798.140(c).
