hi welcome to another episode from our GDPR IQ thought leadership series
here we'll be discussing how the CCPA will force significant changes on
companies not caught by the GDPR in North America the dust from GDPR on may
25th 2018 date has not settled and the data protection community is now bracing
itself for the new California consumer privacy act or CCPA several states in
the US are following the general data protection regulation or GDPR with
similar privacy initiatives on the 28th of June 2018 California passed a
sweeping consumer privacy law CCPA a landmark policy constituting the most
stringent data protection regime in the United States the CCPA is likely to
force significant changes on companies not caught by the gdpr and many
businesses must prepare to scramble to comply if you've worked hard to comply
with GDPR you now have additional work to prepare for the CCPA
implementation in 2020 as of January 1st 2020 Californians will enjoy a higher
level of data protection as EU citizens do under the GDPR the core of the
CCPA consists of five new rights awarded to Californians a right to know what
personal information is being collected about them a right to know whether their
personal information is sold or disclosed and to whom a right to say no
to the sale of personal information a right to access their personal
information and a right to equal service in price even if they exercise their
privacy rights the CCPA also contains less obvious
rights embedded in the legislation such as the right to data Portability and the
right for consumers to benefit from the sale or disclosure their data to third
parties or incentives organizations anywhere in the world that process the
personal data of California residents will be bound by the new regulation if
they or their parent company or a subsidiary meet just one of the
following thresholds generate gross revenue above 25 million dollars to
gather personal information from more than 50,000 California residents
households or devices annually receive at least 50% of their annual revenue
from selling the personal information of California residents a July 2018 trust
Ark survey of executives legal and IT personnel of companies with 500 or more
staff found that just 20 percent of US companies are gdpr compliant the major
challenge cited is the complexity of the legislation and the lack of access to
third party expertise to facilitate a gdpr compliance program clearly the new
level of complexity generated by the gdpr CCPA and emerging laws require a
privacy methodology to manage data from multiple channels and devices your
business at large enrolls such as the marketer must be able to maneuver
through the maze of consumer consent preferences and data requests
as a first step you should learn about the new law and work with a professional
data privacy third-party such as file owned to interpret the new rules and
monitor any changes then commence the following prepare data maps inventories
and other records pertaining to the personal information of California
residents households and devices consider alternative business models
including California only sites and offerings establish designated methods
for submitting data access requests provide a clear and conspicuous do not
sell my personal information link on your websites home page fund and
implement new systems and processes to verify the identity and authorization of
people who request data access deletion or portability update privacy policies
with newly required information including a description of California
residents rights establish policies to avoid charges that your business
willfully disregards the California residence age by implementing methods of
obtaining paranoid and guardian consent from minors under 13 enter a consent of
minors between 13 and 16
privacy legislation will always be subject to change no matter where an
organization is located and in how many countries it operates in phylum
recommends an accountability approach to comply with multiple laws GDPR and CCPA
for organizations operating across jurisdictions our approach to
implementing privacy management policies and procedures is to help organizations
meet multiple laws at the same time take advantage of a free 30-minute gdpr
assessment for your business discuss the state of your compliance with a
qualified practitioner and learn what you need to do to become compliant