Lawyers, including litigators who have experience defending and defeating high-stakes, consumer class action claims both in and out of the courtroom, may have insight to compliance practices as they relate to state and federal privacy regulations that consultants or compliance companies may not possess. Why is this news? Because on everyone’s mind right now are the requirements of the California Consumer Privacy Act (CCPA), which are set to go into effect on January 1, 2020.
When the CCPA officially goes into effect in January 2020 and is interpreted and enforced by the relevant agencies and the courts, it may create the most significant and stringent regime overseeing the data collection practices of companies in the United States. More states are expected to follow with similar litigation. No matter the impetus behind the law’s passage, the statute imposes an array of requirements on companies that are subject to the law. Among them are restrictions and obligations related to the sharing of “personal information” which require companies to impose contractual limitations on vendors, service providers, and other recipients of personal information and to offer California “consumers” the right to opt out of certain disclosures. The focus is on disclosures and sharing of information that qualify as a “sale” – a term that is broadly defined under the CCPA.
Although the CCPA is not set to go into effect until 2020, its provisions require the disclosure of data collected and/or sold over the preceding 12-month period. Moreover, the new law may require some companies (especially marketing and advertising companies) to invest significant time in determining all organizational systems that require updates, and to implement changes across departments with a compliance program that is practical and easy to follow. As we at Blank Rome advise our clients, full compliance with the CCPA will require significant lead-time and resources, making now the time for businesses to begin the process of preparing for compliance with the CCPA.
When the CCPA officially goes into effect in January 2020, it may create
the most significant and stringent regime overseeing the data collection
practices of companies in the United States.
Many of our clients are looking to data inventory and mapping software, and privacy management software and tools to get started. A supplement to this is advice from inside and outside counsel, including litigation counsel. For example, many companies have questions about what disclosures to service providers and vendors are allowed, and what might be considered a ‘sale’ under the law—a question software and tools cannot answer. The CCPA imposes strict requirements on the ‘sale’ of personal information, and companies need to investigate and analyze such practices on a case-by-case basis. It is not one size fits all. Another example is the sensitive issue of how to accommodate a customer’s right to access their data and process and “verify” such requests. The law does not clarify what and how verification would work, creating exposure to companies from insufficient verification practices. Many companies in Los Angeles and across the state and country face unique challenges implementing the California Consumer Privacy Act. This merits attention from professionals as CCPA guidance is developed and similar legislation is considered in other states.
The California legislature has until mid-September 2019 to pass any changes to the CCPA before it goes into effect the beginning of next year. The law’s impact on the various industries we service, including the advertising industries, remains to be seen.
Ana Tagvoryan is a Partner in Business Litigation at Blank Rome LLP in Los Angeles. She is the Vice Chair of the Corporate Litigation practice group, and Co-chair of the Firm’s Class Action Defense team. She can be reached via [email protected] or (424) 239-3465.
To learn more about Blank Rome LLP, visit blankrome.com.
