The California Consumer Privacy Act (CCPA) is a bill that was passed into law in June 2018 with the goal of enhancing privacy rights and consumer protection for residents of California. CCPA goes into effect on January 1, 2020. You can find the full text of the CCPA regulation here on the California Legislative Information page.
CCPA applies to organizations that process any personal data for a California consumer:
If your organization processes the information defined in the above, then the CCPA applies to your business if you satisfy one or more of the following thresholds:
CCPA is the State of California governing bodies recognizing that information (data), and how it is used and protected, has a meaningful impact on the life of its citizens4. When some information about a person is made public by accident (information leak) or on purpose (mis-use), or is used in a way the person did not intend, these actions can result in emotional stress and financial hardship for that person.
The CCPA defines Personal Information as non-public information that “…identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” 1798.140(o)(1-2). Examples of Personal Information are name, email address, IP address, and also internet activity like browsing history. Each regulation has its own definition of personal information, so it is important to know how it is defined in the CCPA (i.e. Personal Information is defined differently in CCPA than how it is defined in GDPR which covers the personal data of EU citizens).
The State of California also recognizes that data misuse has no geo-graphical boundaries. If a person’s data is misused in California or outside of it, the impact on the person is the same. That is why the CCPA applies to business who gather and process data of any California consumer, no matter the business’ location, rather than applying it only to businesses in California. The CCPA is based on data and people, not data processing location.
What the State of California wants organizations to do is protect the personal data of its consumers, regardless of the physical location of the system the data resides on. Protection is to ensure no “unauthorized access and exfiltration, theft or disclosure of a consumer’s nonencrypted or nonredacted personal information”5. (citation to page 2 of the CCPA law document). The definition of how to protect personal data is in section 1798.150.(a)(1) page 19 of the Assembly Bill. The business has the “duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information…”
The CCPA is silent as to what exactly those security procedures are and there is no further definition around security. Because the focus is on breach prevention, the most effective way to ensure your cyber security strategy and controls meet the definition of “reasonable security practices” is to implement an industry standard security framework- for example NIST Risk Management Framework, ISO 27001, CSA CCM for cloud, or CIS Best Practices- to an appropriate degree for the information you process and the technologies you use. Fidelis has mapped our capabilities to many of the NIST 800-53 controls and we believe that this is an appropriate method to help prevent breaches. To learn more, speak with a Fidelis expert.
This article is for informational purposes only and should not be construed as legal advice.
__________________________________________________
1 1798.140 (g), Assembly Bill No 375, page 13
2 1798.140 (o) (1), Assembly Bill No 375, page 14
3 1798.125 (c) (1), Assembly Bill No 375, page 11
4 Section 1, (f), Assembly Bill No. 375, page 3
5 Legislative Counsel’s Digest, Assembly Bill No. 375, page 2
