On the 1 January 2020, the California Consumer Privacy Act (CCPA) came into effect and subsequently introduced a broad range rights, obligations and enforcement measures relating to the protection of consumers’ information (found here: CCPA).
As this is a Californian law, you may be wondering how this applies to Australian business. The CCPA has an extra-territorial scope that may capture some Australian companies that engage in business in the State of California, irrespective of whether that business has a physical presence in California.
Will your business fall under the scope of the CCPA?
In brief, the CCPA apply to businesses that:
- collect “personal information” from Californian residents;
- busines engages in business in California;
- satisfies one of the following:
- revenue threshold: has an annual gross revenue in excess of US$25,000,000; or
- number of consumers: obtains personal information of 50,000 or more of consumers, households or devices annually; or
- business type: derives 50 percent or more of its annual revenue from selling the personal information of consumers.
What obligations does this impose?
In brief, some of the obligations imposed include:
- new consumer rights in relation to personal information.
- Requirements that businesses to update their privacy policies to reflect the CCPA’s new disclosure requirements.
- requirement to provide consumers with a notice about the categories of personal information that will be collected from the consumer and the purposes for which the personal information will be used.
- Giving consumers the right to know what personal information is being collected about them and the purposes for which it is being used, the right to delete personal information, and the right to “opt-out” of the sale of their personal information.
- Prohibits businesses from selling personal information of consumers who are under the age of 16, unless an exception applies.