CCPA

6.1 Scope of the Law

1. Business for CCPA defined in the statute, means any legal entity “organized or operated for the profit or financial benefit of its shareholders or other owners” which alone, or jointly with others, “determines the purposes and means” of processing consumers’ personal information, provided that the entity does business in California.

   1. annual gross revenues exceeding $25 million

   2. Buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices.”

   3. Receives 50 percent or more of annual revenue results from sales of consumers’ personal information.

Personal Information

1. 4. CCPA defines personal information as any “information that identifes, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household

   5. CCPA does not apply to “deidentifed” information used by a business.

Sale

1. Under the CCPA, the sale of personal information includes any disclosure of personal information “to another business or third party” in exchange for value of any kind, monetary or otherwise.

6.2 Notice

Businesses provide notice to consumers in a number of distinct provisions.

1. Initial Notice - at point of collection tell consumer

2. Website Notice -

3. Right to opt out - if business sell consumer info

6.3 Individual Rights Concerning Personal Information

Right to request disclosure of business’ data collection and sales practices

1. Consumers have the right to request that businesses that collect personal information about consumers disclose

Right to request specific personal information collected

1. Consumers have the right to request “specific pieces of personal information” collected by businesses.

Right to have certain information deleted

1. Businesses that collect personal information about consumers must delete such personal information in response to a veri able consumer request, unless an exception applies, and delete any service providers holding such information to delete it as well.

Right to request that personal information not be sold to third parties (if applicable)

1. Consumers may request information about the consumer’s personal information that the business has sold or otherwise disclosed to third parties.

Right not to be discriminated against because of exercising these rights

1. CCPA forbids discriminating against consumers who exercise any of the above rights

6.4 Data Breach

1. CCPA provides consumers with a private right of action and is the first U.S. statute to expressly allow consumers to recover statutory damages as a result of data security incidents.

6.5 Enforcement

1. For violations of the CCPA, California’s a orney general is permitted to bring enforcement actions.These actions may be brought against any company or individual that violates the act.