Monthly Archives: July 2018

California Consumer Privacy Act (CCPA)—Or should we say CDPR?

California Consumer Privacy Act, Data Privacy, GDPR, ,

Just when you thought you could catch your breath, California, on June 28, 2018, enacted the strictest data privacy law in the United States—the California Consumer Privacy Act (“CCPA”). With striking resemblances to the GDPR, the new law will carry with it broad implications for businesses providing services to, or collecting data from, California consumers. By passing the bill, the California legislature secured time to review and amend the law before it becomes effective on January 1, 2020. The ink is far from dry on the new bill, and it will be the center of heated debates before it slams the streets of California.

The tab for non-compliance? Any business that intentionally violates the CCPA may be liable for a civil penalty of up to $7,500 per violation. To put that in context, Yahoo’s 2016 data breach of over 500 million accounts would have amounted in a fine north of 100 billion dollars. Like the GDPR, the CCPA will require organizations to reassess how they are handling personal information, data retention policies, third-party processing contracts, and master privacy policies. To ensure compliance, businesses must take steps similar to those that the GDPR requires, such as data mapping, data inventory, gap analysis, and drafting new privacy policies and contracts.

Like the GDPR, the CCPA will require organizations to reassess how they are handling personal information, data retention policies, third-party processing contracts, and master privacy policies. To ensure compliance, businesses must take steps similar to those that the GDPR requires, such as data mapping, data inventory, gap analysis, and drafting new privacy policies and contracts.

California—with its roughly 39.5 million people—boasts the fifth largest economy in the world. Given that businesses across the globe contribute to California’s growing economy, the CCPA sets the new standard of privacy for anyone transacting business in the United States. In the modern digital world, the CCPA, like its influential digital counterpart—the GDPR, are here to stay and shift privacy rights back to the hands of consumers. Let us help you with this hurdle to CCPA compliance.

See chart below for a comparison of the CCPA and the GDPR.

General Data Protection Regulation (GDPR) California Consumer Privacy Act 2018 (CCPA)
The basis for consent Opt-in Opt-out
To whom it applies Anyone processing or controlling the processing of personal data of individuals located in the EU. For-profit businesses that process personal data of CA residents and satisfy one or more of the following thresholds:

A)    Have annual gross revenue of $25 million or more;

B)    Collects, sells or shares for personal purposes the personal information of at least 50,000 consumers, households, or devices; or

C)    Derives 50% or more of its annual revenues from selling consumers’ personal information

 

The law also applies to affiliated, cobranded entities of businesses that meet the above criteria, even if the affiliate doesn’t do business in CA.
Individual Rights 1.     Access

2.     Rectification

3.     Erasure

4.     Restriction of processing

5.     Object to processing

6.     Data portability

7.     Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

 

 1.     The right to know all data collected by a business on you.

2.     The right to know whether their personal information is sold or disclosed and to whom.

3.     The right to say no to the sale of personal information.

4.     The right to access their personal information.

5.     The right to delete your data.
When does it come into effect? May 25, 2018 January 1, 2020
Potential Fines Up to €20 million or up to 4% of the total worldwide annual turnover, whichever is higher. A civil penalty up to $7,500 per violation

 

Private individual right up between $100 and $750 per consumer, per incident.
Time allowed to respond to a request One month 45 days

 

Facebook Page Administrators Faced with the Floodgate of Liability

Data Privacy, GDPR,

The powerful nature of the GDPR has instilled fear among businesses across the globe. As most companies rush toward compliance, some try to hide behind others. Just weeks after the GDPR came into effect, the European Court of Justice (ECJ) decided a case that made clear that businesses cannot avoid liability by hiding behind other companies. The issue before the ECJ concerned a decision from 2011 when the German data protection authority ordered a company to shut down its Facebook page for failing to inform users of the processing and collection of their personal data.

To better understand this issue, it is best to break it down step by step. First, Facebook uses cookies to collect personal data about visitors to the company’s page. Second, the company (Facebook page administrator) obtains the anonymous statistical data about its visitors. Finally, the company tells Facebook to place targeted ads on its Facebook page.

The central issue was whether the company using the Facebook page was a controller, despite that it never obtained or had any access to the personal information collected by Facebook’s cookies. A controller is someone who determines the purposes and the means for the processing of personal data. The data protection authority maintained that the company was the “controller” of the personal data collected through its fan page; therefore, it was responsible. The company denied responsibility for Facebook’s processing of personal data and argued that any action should be brought against the social network.

The Court held that the company was a “controller” and was jointly responsible with Facebook for the processing of data on its page. It reasoned that the administrator of the company’s page contributed to Facebook’s determination of the means and purposes of processing the visitors’ data. Specifically, the page administrator takes part in deciding what data to collect and how to process; the administrator defines a target audience and requests information about the lifestyles and interests of its visitors to the page. The Court stated, “[t]he fact an administrator of a fan page uses the platform provided by Facebook to benefit from the associated services cannot exempt it from compliance with its obligations concerning the protection of personal data.”

This decision highlights the need for page administrators and businesses to take additional steps to ensure GDPR compliance on their pages. The GDPR will fine businesses processing page visitors’ personal data with no lawful basis up to EUR 20,0000,000.00 or 4% of the total annual worldwide turnover. Rather than accept the risk of noncompliance, let us help your business reach its compliance goals today.

Email Marketing Post-GDPR: Untangling Recital 47 in the Pre-ePR Era

Data Privacy, GDPR,

On May 25th, 2018, EU lawmakers unleashed the GDPR—a new privacy law capable of delivering a financial blow to businesses across the globe, not just in Europe. The data which drives email marketing programs must be processed and stored in accord with the GDPR. Recital 47 of the GDPR states: “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”

Businesses may rely on its “legitimate interests” to send postal marketing about a new product to its customers. This means that businesses may send postal marketing without its customers’ consent. However, direct marketing by electronic means such as by emailing complicates the issue.

Although the GDPR governs the data used for email marketing, the Privacy and Electronic Communication Regulation (“PECR”) defines the required permission to send marketing and advertising by electronic means, such as by email. Further, the PECR does not include “legitimate interests” as a lawful basis for electronic marketing by email. To further muddy the water, the PECR will soon be repealed in favor of the new ePrivacy Regulation (“ePR”) that is expected to arrive by late 2019. As a result, sending marketing emails remains subject to the PECR.

As for now, the general rule under the PECR is that businesses may send marketing emails to individuals that have consented to receive them. But, there is an exception for existing customers—known as the “soft opt-in.” This means that consent is not required if an individual’s contact details were obtained during a sale and the individual had the opportunity to opt-out at that time.

As the EU works to introduce the ePR, businesses face the challenge of complying with the GDPR and the PECR. Nevertheless, given the imminent arrival of the ePR, businesses must further prepare for complying with the new regulation too.

Let us help you with this hurdle to GDPR compliance.