 ccpa insights into applicability and preparation ccpa insights into applicability and preparation hemraj tue 10142025 813 ccpa insights into applicability and preparation laszlo s gonc submitted by hemraj on mon 10132025 626 laszlo s gonc cissp first senior fellow divihn cybersecurity center of excellence linkedin url linkedin perspectives tag security in the digital dna expert content laszlo sgonc sort by latest trending ccpa insights into applicability and preparation laszlo sgonc security in the digital dna latest trending image t he california consumer privacy act ccpa is a new regulation on the horizon that organizations must understand and if applicable take action to comply ccpa becomes effective january 1 2020 and time is running out ccpa overview some have compared ccpa to general data protection regulation gdpr and in reality there is some overlap but there are also several differences similar to gdpr ccpa reinforces a key principle privacy is a fundamental right and individuals must be able to control the collection and use of their personal data ccpa is focused on giving the consumer rights to know what personal information is collected to whom it s sold or disclosed to and the ability to exercise rights without fearing discrimination the regulation also imposes responsibility on organizations to process consumer requests manage risk to consumer personal information and respond to breaches in a timely manner the ccpa holds organizations accountable by enforcing fines for violations when they haven t taken proper steps to protect consumers personal information the core consumer rights granted by ccpa are described below as with any regulation caveats are in place to promote fairness to both the consumer and organizations collecting and processing their personal information for example the right to deletion is granted but there are nine exceptions in place that enable organizations to retain consumers personal information regulation section 1798105 d consumer rights under ccpa consumer rights right to disclosure  consumers have a right to know what personal information is collected and whether it s sold or disclosed and to whom the right to disclosure also enables the consumer to receive a copy of their personal data in a standard format right to deletion  consumers may present a request to delete their personal information retained by the organization right to optout  consumers may exercise the right to say no to the sale of their personal information right to nondiscrimination  when consumers exercise rights enabled by the ccpa organizations must not apply financial penalties deny goods and services or provide an unequal service as a result of their requests ccpa applicability ccpa is applicable to for profit organizations collecting personal information from california residents and determining what is done with the data additionally one or more of the following must apply for organizations to be subject to ccpa annual gross revenue is greater than 25mil personal information from 50k consumers households or devices derive greater than 50 of annual revenue generated from the sale of consumer s personal information as with any regulation the definition of personal information influences the impact on organizations need to comply ccpa defines personal information as information that identifies describes or could be reasonably linked to a consumer or household regulation section 1798140 o personal information includes the items listed below the list is not definitive and can change at any time personal information under ccpa personal information identifiers  real name social security number driver s license number email address postal address ip address account id or online identifier commercial information  personal property records purchase history and patterns biometric information  dna fingerprint data and iris scan data electronic activity  search history browsing history and cookie data geolocation  gps data inferences profiling  behavior personal preferences psychological state now that we ve established what ccpa is and how it applies the question becomes what do you have to do to prepare for compliance those organizations familiar with gdpr will notice these steps key considerations for ccpa compliance key considerations for ccpa compliance assess applicability identify the california residents devices and households targeted by the organization determine whether the organization must comply with the ccpa perform data and processing inventory understand what personal data collected and processed additionally identify the third parties the data is sold to this critical step will require significant effort if the data inventory and flows don t exist the effort is worth it because the output can be used for other privacy initiatives and improves the organization s ability to protect the data assess policies include a description of consumer s rights in the organization s privacy policy update website the ccpa requires all web sites to contain a link labeled do not sell my information this link must be conspicuously placed on the web site home page and must enable the consumer to opt out of the sale of their personal information support consumer rights make available two methods to allow consumers to submit requests toll free number and form on website is acceptable additionally implement processes to intake and satisfy requests in a timely manner 45 days from receipt of verifiable request the process must include a preliminary assessment to verify the request before fulfillment apply technical measures and controls organizations must implement practices to understand the privacy impact as new software is introduced scope of data collected changes or processing of personal data changes furthermore leadings practices must be established to protect personal data in the possession of the organization data protection impact assessments dpias are used to assess privacy implications and establish appropriate security controls to manage risk this is followed up with leading practices such as encryption to protect the personal data of california consumers this is important to limit the organization and consumer exposure in the event of a breach or data leakage additionally the ccpa allows the california attorney general to impose significant penalties if breached or leaked data is unencrypted or not redacted there are many additional considerations for data protection but we ll stop here for now the ccpa is primarily focused on privacy but the impact is felt throughout many departments in the organization understanding what personal information you have how it s processed including the sale of the data and how it s protected is on the critical path to establishing ccpa compliance the first two items are needed to establish the right processes to support consumer rights the latter item is needed to ensure personal data is handled responsibly reasonable measures this post provides a basic understanding of the ccpa and what organizations must do to prepare for compliance the regulation is comprehensive and requires a deeper dive to understand how it applies to your organization and the specific next steps needed to achieve compliance additional ccpa information can be referenced on the state of california department of justice or the californian s consumer privacy website before the draft of this post was completed the state of nevada passed its own privacy law advancing the privacy rights of consumers the regulation is more narrow than ccpa but will become effective on october 1 2019 the message here is privacy laws will continue to be passed and organizations will be pressed to comply get ahead of the wave and develop a strong privacy framework that enables reasonable consumer data subject individual rights based on your business model and enforce it by adopting privacy by design methods and effective security program to protect the organization s data and technology assets  