CCPA Is Here – What Lenders Need to Know Now

CCPA Is Here - What Lenders Need to Know Now

Share This Post

The California Consumer Privacy Act (CCPA) is a significant statutory implementation introducing a host of privacy rights for California residents and creating robust obligations for businesses that garner personal data on California residents.

The CCPA took effect on January 1, 2020. The following is brief overview of the new legislation’s key features.

California Consumer Rights

The CCPA was drafted with the intent to enhance privacy rights and consumer protection for California residents with regards to their personal information. The CCPA defines personal information as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household such as a real name, alias, postal address, unique personal identifier driver’s license number, or other similar identifiers. To achieve these goals, the bill grants the following rights to California consumers:

Consumer’s Right to Know

Per the CCPA, California consumers are afforded the right to request what personal information has been collected on them, in addition to what personal information has been sold or otherwise publicly disclosed concerning them. The CCPA also requires covered businesses to remain compliant with verifiable requests from consumers pertaining to the collection, sale, and disclosure of their personal information, and delineates specific procedures and timelines that covered businesses must adhere to when doing so.

Consumer’s Right to Opt-Out

According to the CCPA, California consumers have the right to opt-out of the sale of their personal information. Covered businesses must provide advanced notice of this right to consumers and develop specific methods for consumers to opt-out—such as calling a toll-free number—and honor consumer opt-outs by waiting at least 12 months before again seeking permission to sell their personal information.

Consumer’s Right to Delete

The CCPA, in a similar vein of comparable European data privacy laws, grants California consumers the right to ask that their personal information be deleted. Covered businesses must honor verifiable requests to delete consumer personal information unless an exemption applies—for instance, covered businesses are not required to delete information if maintaining said information is required to complete a transaction or provide a good or service.

Consumer Opt-In for Sale of Personal Information of Minors

Per the CCPA, the personal information of children under age 13 may only be sold if the minor’s parent or legal guardian has given affirmative authorization to the sale. For minors between the ages of 13 and 16, affirmation authorization is still required, but the minor can provide it themselves.

Right to Non-Discrimination

The CCPA prohibits covered businesses from discriminating against consumers for exercising their data protection rights under the new legislation. Accordingly, covered businesses are not allowed to refuse to sell goods or provide services, charge higher prices or lower the quality of their goods or services for the sole reason that a consumer exercised his or her rights pursuant to he CCPA.

Which Businesses Must Comply with the CCPA?

Business entities will fall under the purview of the CCPA and be deemed “covered businesses” if they meet any of the following criteria:

  • Grosses over $25 million annually
  • The business purchases, acquires, or transacts the personal information of at least 50,000 consumers or devices
  • Fifty percent or more of the businesses annual income is attributable to selling consumers’ personal information 

The CCPA creates certain obligations for covered businesses. They must provide notice to consumers at the time of, or in advance of, collecting personal information, and must implement procedures to respond to requests from consumers wishing to opt-out, know, or delete that data. Covered businesses have to respond to requests for consumers to know, delete, and opt out within pre-established deadlines and verify the identity of consumers making those requests. Additionally, businesses under the purview of the CCPA must disclose financial incentives they offer in exchange for the storing or sale of a consumer’s personal data and detail how they determine the value of that data. Covered businesses must retain records of these requests and their subsequent responses for 24 months to prove they are compliant with the new regulations.

CCPA vs. GDPR

The CCPA and the European Union’s General Data Protection Regulation (GDPR) are two distinct pieces of legislation that differ in scope, terminology, and regulatory implementation. As several businesses already have an internal structure in place for the GDPR, they may need to refine their personal information protocol to comply with the CCPA as well.

For example, the GDPR mandates that covered entities conduct a data inventory and map data flows in order to create records demonstrating compliance. Further data mapping procedures may also be a significant step towards CCPA compliance.

The GDPR also requires covered businesses to implement systems to respond to individual requests for access to personal information and for the deletion of personal information. Businesses can apply these processes for processing CCPA consumer requests, but they may need to alter the different definitions of personal information and the applicable regulations pertaining to consumer request verification detailed in the new legislation. The same can be said for the GDPR’s requirement that companies disclose data privacy practices in a privacy policy.

What Should I Do Now?

Assuming you are a covered business, you should make sure your privacy practices match the requirements outlined in CCPA. Our team of compliance experts is always available to help for any business struggling to comply with CCPA or any other consumer related laws which often affect commercial lending businesses.

Questions about this article? Reach out to our team below.
RELATED
Post-Tenancy Eviction Process

Post-Tenancy Eviction Process

After a tenant has been evicted, landlords need to have a well-rehearsed protocol in place to mitigate risk and smoothly transition the unit to the

Residential Eviction Process

Residential Eviction Process

Prejudgment Claim of Right to Possession The landlord has the option of providing notice when the unlawful detainer is served to all individuals who claim

Giving a Tenant Notice What You Need to Know

Giving a Tenant Notice: What You Need to Know

The process of evicting a tenant—regardless of reason—can be an extremely stressful scenario for landlords no matter how experienced. Being proactive and having a thorough