The California Consumer Privacy Act (the \u201cCCPA\u201d) passed as law on June 28, 2019 and became effective on January 1, 2020. The CCPA affects all businesses who do business in California AND either (i) have at least $25 million of annual gross revenue; (ii) buy, sell, share or receive personal data the personal information of 50,000 or more California residents; or (iii) receive over half of their revenue from the sale of personal data of California residents. Fortunately, most financial services entities who do business in California will not meet any of these prongs.<\/p>\n
As of July 1, 2020, the California Attorney General (\u201cAG\u201d) has the right to enforce CCPA against violators, not just in California, but across the nation.\u00a0 Under the CCPA, the AG may recover civil penalties up to $2,500 for each violation and up to $7,500 for each intentional violation.\u00a0 The CCPA also provides for a private right of action subjecting businesses to civil liability resulting from a data breach involving certain defined types of personal information. In fact, CCPA class action litigation has already started to fill the court system.<\/p>\n
There are plenty of articles and information describing what measures are appropriate to ensure compliance with the CCPA. Updating privacy policies, implementing processes to respond to individual consumer requests, ensuring contracts are in place with third-party service providers are all great steps to take.\u00a0 While we recommend reviewing policies and processes early and often, do you know whether the CCPA even applies to your business?<\/p>\n
In calculating the $25 million in annual gross revenue, the CCPA expands the definition of a \u201cbusiness\u201d to entities who control or are in common control with another business and which share a common branding. In this case, the threshold is met when revenues exceed $25 million across all such entities and each entity is subject to the CCPA. Many financial service entities are part of a group of companies, generally controlled or owned by a holding company.\u00a0 For example, a broker-dealer, RIA, and insurance entity are an often used structure for a financial services firm that brands itself as a single corporate entity. In that instance, the revenues of the entities will need to be aggregated.<\/p>\n
The CCPA broadly defines \u201cpersonal information\u201d to encompass information that identifies, relates to, describes, associates with, directly or indirectly, a particular institutional or prospective client. This information includes, without limitation, names, addresses, email addresses, social security numbers, driver\u2019s license or state issued ID number and passport numbers.\u00a0 However, the CCPA exempts from coverage all data required to be obtained by the Gramm-Leach-Bliley Act (the \u201cGLBA\u201d). The GLBA protects nonpublic personal information that is provided by a consumer to a financial institution in connection with obtaining financial products\/services from the institution.<\/p>\n
The GLBA\u2019s definition of nonpublic personal information differs from the definition of personal information under the CCPA, and is limited to individual investor information. Thus, while certain individual investor information may be pre-empted from the scope of the CCPA, personal information of entity investors, institutional investors and prospective investors is not within the scope of the GLBA and as such, will be covered by the CCPA.<\/p>\n
Certain financial services firms may be subject to the CCPA if they have received personal information on more than 50,000 California residents.\u00a0 Firms such as online broker-dealers, mortgage brokers, or insurance entities often collect information on prospective clients and store that information on their servers. In fact, IP addresses, browsing history, and information regarding a consumer’s interaction with a website (often collected by cookies) is considered \u201cpersonal information\u201d that is subject to the CCPA.\u00a0 Accordingly, it is incumbent on firms to check how many California residents\u2019 data they have received to be sure they are not subject to the mandates of the CCPA.<\/p>\n
This is probably the easiest criteria to understand.\u00a0 Do you sell the data you collect from your customers and potential customers?\u00a0 If you do, there may be other privacy statutes you need to know about.\u00a0 In fact, the CCPA may not be your only regulatory hurdle to overcome. Nonetheless, you should take a long look at what percentage of revenue it comprises for your business.\u00a0 If it is more than half of your revenues, using even the most conservative definition of \u201crevenues\u201d, you will be subject to the CCPA.<\/p>\n
To the extent a firm collects personal information of clients or prospective clients that is subject to the CCPA, there are specific consumer rights that must be observed.\u00a0 Those rights include the right to request disclosure of information that is collected and shared, the right to delete personal information, and the right to non-discrimination. Compliance with the CCPA is not difficult, but does take some effort to get it right.<\/p>\n
Whether a firm is subject to the CCPA is a fact specific analysis.\u00a0 If you are concerned about whether you are subject to the mandates of the CCPA, feel free to reach out the lawyers at Higgs Fletcher & Mack for the appropriate guidance.<\/p>\n","protected":false},"excerpt":{"rendered":"
The California Consumer Privacy Act (the \u201cCCPA\u201d) passed as law on June 28, 2019 and became effective on January 1, 2020. The CCPA affects all businesses who do business in California AND…<\/p>\n","protected":false},"author":57,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[9,136],"tags":[],"coauthors":[],"class_list":["post-8448","post","type-post","status-publish","format-standard","hentry","category-attorney-articles","category-firm-articles","attorney-kevin-l-wheeler","practice-privacy-information-security"],"acf":[],"yoast_head":"\n