Business for CCPA defined in the statute, means any legal entity “organized or operated for the profit or financial benefit of its shareholders or other owners” which alone, or jointly with others, “determines the purposes and means” of processing consumers’ personal information, provided that the entity does business in California.
annual gross revenues exceeding $25 million
Buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households, or devices.”
Receives 50 percent or more of annual revenue results from sales of consumers’ personal information.
CCPA defines personal information as any “information that identifes, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household
CCPA does not apply to “deidentifed” information used by a business.
Under the CCPA, the sale of personal information includes any disclosure of personal information “to another business or third party” in exchange for value of any kind, monetary or otherwise.
Businesses provide notice to consumers in a number of distinct provisions.
Initial Notice - at point of collection tell consumer
Website Notice -
Right to opt out - if business sell consumer info
Consumers have the right to request that businesses that collect personal information about consumers disclose
Consumers have the right to request “specific pieces of personal information” collected by businesses.
Businesses that collect personal information about consumers must delete such personal information in response to a veri able consumer request, unless an exception applies, and delete any service providers holding such information to delete it as well.
Consumers may request information about the consumer’s personal information that the business has sold or otherwise disclosed to third parties.
CCPA forbids discriminating against consumers who exercise any of the above rights
CCPA provides consumers with a private right of action and is the first U.S. statute to expressly allow consumers to recover statutory damages as a result of data security incidents.
For violations of the CCPA, California’s a orney general is permitted to bring enforcement actions.These actions may be brought against any company or individual that violates the act.