By: Minh Luong and Neharika Salhotra

What is the California Consumer Privacy Act?

The California Consumer Privacy Act (CCPA) is a data privacy law that became effective as of January 1, 2020. This law outlined new standards for data collection what would happen to businesses if they failed to adhere to these standards. The act protects several consumer rights including a right to refuse sale of information, right to request deletion of data, and a private right of action to any breaches, among other rights. The CCPA will allow businesses a 30-day period to amend violations by showing proof of amendment and that no more violations will occur. Failing to do so would result in significant penalties of up to $7,500 for every intentional violation.

How Does it Affect Small Businesses?

Small businesses in California, although not targeted, may face the impact of this bill. Specifically, any business earning a minimum of $25 million in revenue per year, selling at least 50,000 consumer records per year or deriving 50% or more of its annual revenue from selling personal information would be affected by the bill. Most small businesses will remain unaffected by this provision. Yet, small businesses may be incentivized to start preparing for consumer rights litigation that may be applicable to them in the future. The penalties for these violations are severe, and as consumer rights become a more prevalent topic in the US and especially California, small businesses should take measures to protect themselves from these hefty penalties that could eat away at their profits.

How Should Small Business Prepare?

1. Reexamine CCPA Criterion: “Small” may be a misleading term at times. Qualifying as a small business does not automatically exempt you from the CCPA guidelines and businesses should look into the eligibility criteria and their own company statistics to determine their company’s status. The State of California Department of Justice clarifies that a business will be eligible if it meets any of the following:
   1. Have a gross annual revenue of over $25 million.
   2. Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or
   3. Derive 50% or more of their annual revenue from selling California residents’ personal information.
2. Remember That Location is Irrelevant: The CCPA, although a California law is applicable to consumers in California. The business could be located anywhere, however, if a resident of California uses and chooses to take legal action against a certain business, it can go ahead and do so.
3. Prepare a Transition Process: Regardless of whether a business is eligible; all small businesses should take measures to transition into maintaining an effective data privacy system at their company. This could include ensuring their data collection methods, allowing for consumers to opt out, placing new security measures to protect consumers’ information, and learning about the rights of consumers under CCPA and create a process for honoring those rights going forward.
4. Train Employees Thoroughly: Employee training is crucial to correct implementation of CCPA. This includes training in data management techniques, retrieving and responding to consumer complaints in a timely manner, and preparing summaries and answers to any questions consumers may call with concern about.
5. Soliciting Legal Advice from a Compliance Lawyer: One of the most fool proof ways to ensure compliance with the CCPA is to hire an attorney that can ensure you are covering all your bases with regards to the new law. Furthermore, in cases where management cannot understand how to tackle a certain situation or difficult decisions need to be made, a compliance lawyer can give your business personally tailored advice that is best suited to your businesses’ needs and in accordance with the law. The skilled attorneys at Chugh, LLP are ready to help with any compliance needs, or answer any questions small business owners may have.

Work Cited

• “How the California Consumer Privacy Act Will Affect Small Businesses – Businessnewsdaily.com.” Business News Daily, www.businessnewsdaily.com, https://www.businessnewsdaily.com/10960-ccpa-small-business-impact.html. Accessed 26 Aug. 2022.

• “CCPA.” CCPA, theccpa.org, https://theccpa.org/. Accessed 26 Aug. 2022.

• “California Consumer Privacy Act (CCPA) | State of California – Department of Justice – Office of the Attorney General.” State of California – Department of Justice – Office of the Attorney General, oag.ca.gov, 15 Oct. 2018, https://oag.ca.gov/privacy/ccpa.