Insights
Alert: California Consumer Privacy Law Act of 2018 Amendments Signed into Law
On October 11, 2019, Governor Gavin Newsom signed into law amendments to the California Consumer Privacy Law Act of 2018 (“CCPA”). The amendments include a requirement that certain businesses that sell California resident consumer Personal Information must register as “Data Brokers” with the California Attorney General by January 31, 2020.
WHAT YOU NEED TO KNOW
This new law established a registration requirement in California for Data Brokers. Under the new law, a Data Broker is a Business that knowingly collects and sells to third parties the Personal Information of a California Consumer with whom the Business does not have a direct relationship.
- “Collecting” includes buying, renting, gathering, obtaining receiving, or accessing any Personal Information pertaining to a California Consumer by any means;
- “Selling” includes selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a Consumer’s Personal Information to another business or third party for monetary or other valuable consideration.
Because the terms Personal Information, Collecting, and Selling are defined broadly, a business should carefully consider whether its activities qualify it as a Data Broker. The key feature of a Data Broker (as opposed to other types of business) is that the Data Broker does not have a direct relationship with the consumer whose Personal Information it collects and sells. Failure to register can subject businesses to California Attorney General action including injunction, civil penalties and fees.
The California Data Broker law is in effect, requiring Data Brokers to register with the California Attorney General by January 31 of every year, beginning in 2020; however, the Attorney General has not yet created a mechanism for registration or publication to a statewide public registry, regulations have not yet been promulgated, and the other elements of the CCPA will not be enforced until July 1, 2020. We expect that Data Brokers will need some lead time to comply with the new law.
WHAT YOU NEED TO DO
While we await final regulations relating to how businesses are expected to register, a company that conducts business in California should evaluate whether it: (i) qualifies as a “Business” under the CCPA; (ii) collects “Personal Information” of California residents; and (iii) is “selling” Personal Information of Consumers with whom the business does not have a direct relationship.