Embed Size (px)
Citation preview
California Businesses Beware:The California Consumer Privacy Act (CCPA)
Is Here and It Is Only the Beginning
Tara ChoPartner, Privacy and CybersecurityWomble Bond Dickinson (US) LLP
Kristin Walker-ProbstPartner, Businesss Litigation
Womble Bond Dickinson (US) [email protected]
Nicole SuAssociate, Business Litigation
Womble Bond Dickinson (US) [email protected]
Meet the Panelists
Robert KangProfessor, Loyola Law School
Robert TaylorAssociate General Counsel
J2 Global, Inc.
AgendaOur Discussion Will Cover:
1. Legislative Background – and What’s
Next
2. CCPA Enforcement and Litigation
3. Operational Challenges and Trends
Legislative Background –
and What’s Next
California Consumer Privacy ActTimeline and Enforcement
2018 2019 2020
MarchCambridge AnalyticaFacebook
JuneABA 375 signed into law
MayCA Data Privacy Measure Ballot Initiative collects 600,000 signatures
GDPR in effect
March - MayPublic Forums
MayCA Legislature considers amendments
December 6AG provides proposed text of regulations
October 10AG provides proposed
text of regulations
JanuaryCCPA in effect
JulyDue date for publication of regulations and AG enforcement
NovemberCPRA (“CCPA 2.0”)
ballot vote
California Consumer Privacy ActWho Does It Apply To?
For-profit companies doing business in CA that collect personal information about CA residents AND:
OR
OR
Annual gross revenue >25M;
Buys, sells or shares data of > 50K consumers,
households or devices;
Derives >50% annual revenue from selling
personal information.
November 2020 BallotThe CPRA Takes it Further
Removes 30-day cure period for breach and non-compliance
Additional rights and restrictions for sensitive data
Extends partial exemptions for B2B and employee data
Stiffer fines relating to minors
CA Privacy Protection Agency
Right to restrict use and disclosure; extends lookback period
Enforcement and Litigation
CCPA Enforcement Process
Notification letters went out July 1
AG did not disclose companies
Complaints based on social media and other investigations
Priority on data breaches affecting large populations,egregious conduct,vulnerable populations
Beginning July 1, 2020
10
CCPA LitigationAlleged Conduct Violating the CCPA
27 Cases(73%)
15 Cases(41%)
6 Cases(16%)
0
5
10
15
20
25
30
Data Breach/Unauthorized Access
Lack of Notice at Collection
No Opt-Out
*Data encompasses all cases filed in California since January 2020
11
28 Cases(76%)
36 Cases(97%)
15 Cases(41%)
4 Cases(11%)
8 Cases(22%)
0
5
10
15
20
25
30
35
40 Consumer Privacy Act
Unfair Competition Law
Consumer's Legal Remedies Act
Customer Records Act
Confidentiality of Medical InformationAct
CCPA LitigationAlleged Violations of CA Statutory Counts
*Data encompasses all cases filed in California since January 2020
What Keeps You Up At Night?Operational Challenges and Trends
Questions?https://www.womblebonddickinson.com/us/insights/alerts/ccpa-task-force
