CCPA
CCPA - correct answer ✔✔The California Consumer Privacy Act (CCPA) June 28, 2018
This provides a comprehensive regime of consumer privacy rights, such as those found in data protection
laws and outside the US- most prominently Europe's GDPR.
The CCCPA regulates the collection, use an sharing of personal information more broadly than any prior
US Law. Under the CCPA, these rights include the right to request disclosure of business' data collection
and sales practices, the right to request specific personal information collected, the right to have certain
information deleted, the right to request that personal information not be sold to 3rd parties (if
applicable) and the right not to be discriminated against because of exercising these rights.
CPRA - correct answer ✔✔California Privacy Rights Act - if enacted by voters, this initiative would
significantly expand individual rights and business obligations, for example, by preventing "sensitive
personal information" from being used for advertising purposes.
CCPA definition of Business - correct answer ✔✔The CCPA applies to any statutorily defined business.
The word business, as defined in the statute, means any legal entity "organized or operated for the profit
or financial benefit of its shareholders or other owners" which alone, or jointly with others, "determines
the purpose and means" of processing consumers' personal information provided that the entity does
business in California, and meets one of the following additional requirements:
-Has annual gross revenues exceeding $25 million
-"Alone or in combination, annually busy, receives for the business's commercial purposes, sells or
shares for commercial purposes along or in combination the personal information of 50,000 or more
consumers, households or devices.
-Receives 50% or more of annual revenue results from sales of consumers personal information.
This excludes:
non-profit organizations which are not organized for the profit of financial benefit of its owners
-entities which do not determine the "purpose and means" of processing consumer personal
information
, -entities which do not conduct any California business.
3rd parties - correct answer ✔✔There is one provision of the CCPA that applies to 3rd parties who may
not meet the above statutory definition of "business". These 3rd parties may NOT sell personal
information that has been sold to the 3rd party by a business unless a consumer has received express
notice and an opportunity to opt out of the sale.
Personal Information Definition - correct answer ✔✔The CCPA defines personal information as
"information that identifies, relates to, describes, is capable of being associated with, or could
reasonably be linked, directly or indirectly with a particular consumer or household".
An important note that household is used! Personal information includes the ability to identify a home.
Deidentified Information - correct answer ✔✔The CCPA does not apply to "deidentified" information
used by a business.
Information is deemed deidentified if it cannot "reasonably identify, relate to, describe, be capable of
being associated with, or be linked, directly or indirectly to a particular consumer.
However the CCPA requires businesses to adopt and implement certain measures when using
deidentified information including:
-Technical safeguards that prohibit reidentification of the consumer to whom the information may
pertain to
-Business processes that specifically prohibit reidentification of the information
-the business must not attempt to reidentify the information.
Data Sale - correct answer ✔✔Under the CCPA, the sale of personal information includes any disclosure
of personal information to another business or 3rd party in exchange for value of any kind (monetary or
other).
A data sale does NOT include:
-disclosure of personal information directed by the consumer (or where a consumer intentionally
interacts with a 3rd party through the business)
CCPA - correct answer ✔✔The California Consumer Privacy Act (CCPA) June 28, 2018
This provides a comprehensive regime of consumer privacy rights, such as those found in data protection
laws and outside the US- most prominently Europe's GDPR.
The CCCPA regulates the collection, use an sharing of personal information more broadly than any prior
US Law. Under the CCPA, these rights include the right to request disclosure of business' data collection
and sales practices, the right to request specific personal information collected, the right to have certain
information deleted, the right to request that personal information not be sold to 3rd parties (if
applicable) and the right not to be discriminated against because of exercising these rights.
CPRA - correct answer ✔✔California Privacy Rights Act - if enacted by voters, this initiative would
significantly expand individual rights and business obligations, for example, by preventing "sensitive
personal information" from being used for advertising purposes.
CCPA definition of Business - correct answer ✔✔The CCPA applies to any statutorily defined business.
The word business, as defined in the statute, means any legal entity "organized or operated for the profit
or financial benefit of its shareholders or other owners" which alone, or jointly with others, "determines
the purpose and means" of processing consumers' personal information provided that the entity does
business in California, and meets one of the following additional requirements:
-Has annual gross revenues exceeding $25 million
-"Alone or in combination, annually busy, receives for the business's commercial purposes, sells or
shares for commercial purposes along or in combination the personal information of 50,000 or more
consumers, households or devices.
-Receives 50% or more of annual revenue results from sales of consumers personal information.
This excludes:
non-profit organizations which are not organized for the profit of financial benefit of its owners
-entities which do not determine the "purpose and means" of processing consumer personal
information
, -entities which do not conduct any California business.
3rd parties - correct answer ✔✔There is one provision of the CCPA that applies to 3rd parties who may
not meet the above statutory definition of "business". These 3rd parties may NOT sell personal
information that has been sold to the 3rd party by a business unless a consumer has received express
notice and an opportunity to opt out of the sale.
Personal Information Definition - correct answer ✔✔The CCPA defines personal information as
"information that identifies, relates to, describes, is capable of being associated with, or could
reasonably be linked, directly or indirectly with a particular consumer or household".
An important note that household is used! Personal information includes the ability to identify a home.
Deidentified Information - correct answer ✔✔The CCPA does not apply to "deidentified" information
used by a business.
Information is deemed deidentified if it cannot "reasonably identify, relate to, describe, be capable of
being associated with, or be linked, directly or indirectly to a particular consumer.
However the CCPA requires businesses to adopt and implement certain measures when using
deidentified information including:
-Technical safeguards that prohibit reidentification of the consumer to whom the information may
pertain to
-Business processes that specifically prohibit reidentification of the information
-the business must not attempt to reidentify the information.
Data Sale - correct answer ✔✔Under the CCPA, the sale of personal information includes any disclosure
of personal information to another business or 3rd party in exchange for value of any kind (monetary or
other).
A data sale does NOT include:
-disclosure of personal information directed by the consumer (or where a consumer intentionally
interacts with a 3rd party through the business)
