The California Consumer Privacy Act (CCPA) is just over a month away from going into effect. Are you ready? Take a few minutes to get a final recap of the legislation.
 |
In our previous blog post, we explored several different reasons why the CCPA (California Consumer Privacy Act) could actually be a good thing for marketers. As with everything, there are always two sides to the coin. Take a look at how both sides might consider the upcoming regulation.
In our blog post from 7/17/2019, we shared our POV on how the CCPA can actually be a good thing for marketers. CCPA regulation calls for:
- Right to access of the personal information being collected
- Right to be forgotten or deletion of that personal information upon request
- Right to opt-out of the collecting and selling of that personal information
- Be free of discrimination for exercising these rights
To comply with this regulation, advertisers will need to consolidate data, which in turn supports a customer centric view of the data, and allows for the implementation of more strategic, omni-channel, personalized marketing outreach. The ability to market to consumers in this way will lead to greater demand and this is a good thing!
Getting to this point though is not without its challenges. The requirements for compliance with CCPA will be onerous for many and marketers are working feverishly to be ready for January 1st, 2020. Businesses will need to make changes to the way they collect, maintain and use personal information to support the “right to know and the right to say no”.
Giving Notice
Providing notice and choice to consumers became standard practice in the support of consumer privacy back in the late 90’s. Presumably, you are already in compliance with this requirement. Data protection policies, including the language for all consumer facing content may still need to be updated.
Definition of Personal Information
The CCPA defines personal information as any information about a consumer or a household. Is your definition aligned? Many marketers do not consider any and all data to be personal. Is your definition one that includes the entire household? It is not uncommon for marketers to maintain customer information at the individual level to better support the relevancy of the messaging. Householding of this data may be necessary.
Integration of Business Systems
So many marketers today are still working through the challenges associated with the introduction of new marketing channels. When one team is focused on email, another focused on digital and yet another focused on offline, it is often the case that consumer data is being maintained across multiple databases. This disparate data needs to be consolidated and managed through a single system, a tech stack that has the features needed to support privacy, access and consent requirements.
Vendor Compliance
In addition to your own business meeting the requirements of compliance, you are also responsible for ensuring the vendors you work with are also in compliant. This will likely result in the need to modify existing contracts to ensure privacy clauses are clearly stated.
Points of Contention
There are of course some who are working hard to have the CCPA amended. The bill initially passed on June 18, 2018. Opponents of the law reference the rushed legislative process (seven days) in which this bill was passed, allowing the bill to contain a number of ambiguities and contradictions, most notably the definition of the consumer and the definition of personal data.
CCPA defines consumer information to include: “[I]information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” This is an extremely broad definition that includes data that may or may not be true about a consumer, may be objective or subjective (as in an opinion) and doesn’t clearly state the information considered personal when pertaining to the entire household. If a consumer is an individual person that is defined as a “single human being, distinct from a group, class or family”, how does this definition translate to a household?
Almost immediately after passing, more than 40 additional bills were proposed; some focused on expanding the CCPA’s private right of action (a private person’s legal entitlement to enforce their rights) while others, to the contrary, focused on clarifying the legislation and limiting the scope. Privacy advocates and tech lobbyists each working hard to protect their best interests. The answer will lie in providing that balance between protecting consumers and protecting businesses. September 13, 2019 is the deadline for final changes to the law’s wording.
“No one disputes that the privacy of personal information in the digital age is vitally important. Indeed, this is a point on which all of the stakeholders—consumers, regulators, brands, retailers, data platforms, and data providers—agree. But the CCPA does not build on that common ground; it fractures it, dividing “consumers” (meaning all residents of California) from businesses (whether in California or not), and pitting them against one another in a litigation posture by creating a (limited) private right of action for consumers. If everyone is agreed on the goal—protecting personal privacy in online communications and commerce—there has to be a better way than manufacturing a conflict between the California attorney general and California residents on the one hand and online businesses and their service providers on the other.” David Swetnam-Burland, Brann & Isaacson.
Opponents of the law in its current form, are requesting clarity, with the intent of ensuring businesses can fully and efficiently comply while continuing to deliver benefit to consumers.
For more information on the proposed amendments, you can reference this article by David Strauss which nicely summarized the amendments.
https://www.bytebacklaw.com/2019/03/a-deep-dive-into-proposed-amendments-to-the-ccpa/ https://www.sixfifty.com/legislative-updates-to-the-ccpa/
Final Thought
Regardless of what happens on September 13th, marketers should not delay their efforts to bring their business into compliance with the law. While modifications may pass, there is no expectation of widespread changes. The core components of the law are not in dispute (Right to Access, Right to be Forgotten and Right to Opt-out) and smart marketers will use this regulation to their advantage by driving loyalty through compliance and providing greater relevancy in their marketing efforts.
