SACRAMENTO, Calif. (Legal Newsline) – California's new Consumer Privacy Act will affect businesses as it introduces a limited private right of action and other penalties for violations.
And there will also be compliance rules, all of which will affect not just California-based companies but any firms in the country doing business in the state that have $25 million in gross revenue, hold the personal data of more than 50,000 in the state, or where 50 percent of revenue comes from selling personal information. The law is scheduled to go into effect January 2020.
But it is hard to gauge how the roll out of the Act will play out as "“we are still waiting to see if it will be amended," said Miriam Farhi, a partner and privacy expert with Perkins Coie in Seattle, Washington.
"The process that led to this Act is unique," Farhi told Legal Newsline, adding that it was really introduced to head off a ballot initiative, so had to be rushed through.
"There are some inconsistencies between this and California's existing privacy laws, and California’s existing privacy laws and amendments would help clean those up," Farhi said.
Farhi said she believes the Act "moves the needle" in the United States and it is certainly the most comprehensive state law that regulates privacy. It does not rise to the level of the new European General Data Protection Regulation (GDPR), and legislators in California likely found some inspiration in some of its provisions.
The attorney will not be surprised if other states will follow with their own privacy statutes, and some already are, such as Vermont. Chicago also has an ordinance dealing with how businesses process information.
In short, the privacy law gives consumers a right to know the personal information held by a business within a year of it being collected, what is sold to a third party or revealed for business purposes.
Businesses need to set up a mechanism to make a request and answer within 45 days.
Under the right of action, a consumer must give 30 days' notice to a company, while also notifying the Attorney General's Office, which will decide if a consumer can proceed. Damages between $100 to $750 can be assessed for every violation.
The attorney general can also take action under the Unfair Competition Law, with a civil penalty of up to $7,500.