These laws protect consumer’s privacy, but they apply to very different situations. You must understand your rights under these laws and the dangers that present themselves when companies do not comply with them.
The state of consumer data collection today
As of 2018, more than 2.5 quintillion bytes of data were created every year, but it is projected that the amount of data generated each day by 2025 will be 463 exabytes. Today, much of the data is considered “big data.” What is big data? This refers to data whose size is so large that it is beyond the ability of traditional databases to capture, manage and process it. Businesses are all too happy to obtain this valuable data to drive sales and connect with customers. Today’s marketing is all about making it personal to the customer. Businesses are increasingly able to do this by collecting massive amounts of data about their customers and anyone who visits their website. This allows them to tailor their marketing message to you, based on your specific characteristics. Business News Daily reports that the most common types of data that companies collect about consumers are:
Personal data: Names, dates of birth, addresses, gender, IP addresses, web browser cookies and device IDs. Engagement data: How consumers interact with a website, email, paid ad and more. Behavioral data: Purchase histories, repeated action and mouse movement information. Attitudinal data: Consumer satisfaction, product desirability and purchase criteria.
Companies using consumer data for good and bad
Using consumer data can go exceptionally well or spectacularly bad. On the good side, Netflix uses big data to make suggestions about the next movie or program you should watch, based on your past search and watch data. Other subscribers with similar interests also play a part. Netflix’s recommendation system influences about 80% of what is streamed on the mega platform. But, then there is the bad where companies have used big data in potentially harmful ways. Take Vizio. The affordable tv brand tracks information about each owner and shares this information with companies to deliver targeted ads. The worst thing about it is that the company never asks permission to track and report your information, which is why the company is currently embroiled in a messy lawsuit. Talking about privacy violations, there is CVS, which the U.S. Department of Health and Human Services has found has violated federal patient privacy laws at least 200 times in four years. Complaints include one patient’s medication being delivered to his neighbor, which revealed he had cancer, a pharmacist yelling personal information across the counter, and the company dumping prescription bottles in unsecured dumpsters. Then, there is Ashley Madison, the notorious website whose current tagline is “Life is short. Have an Affair.” It was hacked and threatened to release personal information about its users unless the site was taken down. The company refused to give in to the threat, and the hackers released data on thousands of its adulterous users. A lawsuit has since been filed, seeking more than $578 million from the company founded on lying and cheating.
What do governments do to protect consumer data rights?
Governments are taking an increasing interest in protecting consumer data rights. They often pass broad-ranging consumer protection laws in the interest of protecting consumers’ private data. Some examples of these initiatives include:
HIPAA: The Health Insurance Portability and Accountability Act is a U.S. law that established procedures for the exercise of individual health information privacy rights and limiting the disclosure of private health information. GDPR: The General Data Protection Regulation is a European Union regulation on data protection and privacy. CCPA: The California Consumer Privacy Act gives consumers the right to know about the data being collected about them, the right to delete this data and the right to opt-out of collection. CalOPPA: The California Online Privacy Protection Act requires websites to post a privacy policy if they collect personally identifiable information. UK Data Protection Act: The United Kingdom Data Protection Act protects personal data stored on computers or paper and gives consumers the right to control information about themselves.
California consumer privacy act
The California Consumer Privacy Act protects the consumer privacy rights of people who live in California. Companies must provide more information to consumers about how they are collecting data about them and what they are doing with it. Consumers are given the right to opt-out of having their information shared or otherwise used in a way they do not approve of. The law applies to for-profit businesses that have $25 million or more in annual revenue, have the personal data of at least 50,000 individuals, households, or devices or earn more than half of their annual revenue by selling the personal information of consumers. The law exempts certain types of businesses, such as banks, credit reporting agencies and health providers. The CCPA applies to personal information, such as:
Names Social Security numbers Phone numbers Physical addresses Email addresses IP addresses Online handles Biometric information Geolocation data Browsing and search history Records of products purchased
Consumers have limited rights to protect their rights under the CCPA. For example, they may be able to sue a company if a data breach occurs and affects them if certain conditions are met. In some instances, consumers can sue for monetary damages for the actual damages they suffered or statutory damages of $750 per incident. The attorney general can file an action against businesses if it identifies patterns of misconduct or other violations of the CCPA.
California online privacy protection act
The California Online Privacy Protection Act (CalOPPA) applies to businesses that are located in California, as well as businesses that collect personal information from California residents. This privacy law requires companies to:
Post a public privacy policy on their website and make it easy to find. Inform consumers of what types of personal information they collect and with whom they share it. Update users regarding changes in their privacy policy. Post an effective date for their privacy policy. Give website or mobile app users an easy way to review and change their personal information. Explain how they respond to Do Not Track signals from web browsers and provide information about how to block this type of technology.
What is the difference between CCPA and CalOPPA?
The CCPA and CalOPPA are two very important consumer privacy laws, but they do have many differences, including in their:
Scope
While both laws are consumer protection acts, they apply to different people. Both acts intend to protect the privacy of California consumers, who is anyone that resides in California. Both are addressed to commercial enterprises. The CalOPPA applies to the operators of commercial websites, mobile apps or online services that collect personal information from California consumers. Therefore, the CalOPPA can apply to businesses in California, in Utah or Switzerland. In contrast, the CCPA applies to any business that impacts people in California, which it defines as any legal entity that:
Pursues a profit Operates in California Decides why and controls how consumers’ personal information is processed Has an annual gross revenue of more than $25 million, collects personal information from at least 50,000 devices, consumers, or households or makes at least 50% of its annual revenue by selling consumers’ personal information
Requirements
Each of the acts requires that the entities to which they apply fulfill certain legal requirements. Under these laws, you must:
CalOPPA
Display a public privacy policy on your websites Disclose what type of personal information you collect Provide a list of categories of third parties that may receive consumers’ personal information Describe the process you have in place for consumers to review and request changes to their personal information Disclose the date the privacy policy takes effect ·Explain whether your website honors Do Not Track signals Explain whether consumers’ personal information will be shared outside of your website where your website integrates third-party software or resources
CCPA
Describe consumers’ rights under the law and how they can be exercised Amend your privacy policy to include certain information and update your policy at least once a year Require children to opt into any sale of their personal data Provide the list of categories of personal information that the business has collected, sold or shared in the past year Provide a link to allow consumers to decline their personal information from being sold Provide notices that meet certain requirements
Consumer rights
The CalOPPA gives consumers the right to know about how their consumer information is collected via the display of a privacy policy. Under the CCPA, consumers have the right to:
Know: Consumers are entitled to know how you will collect their data, what type of data you may collect and what you will do with it. Decline: Consumers can ask the business not to sell their information, and the business must comply. Delete: Under certain situations, you must delete the customer’s information. Not be discriminated against: You cannot discriminate against consumers for exercising these rights.
Does your business fall under the CCPA or CalOPPA?
Your business might fall under the CCPA, the CalOPPA or both laws. This will depend on:
What type of business you have Whether you collect personal information from California residents The amount of annual revenue of your business How many people, devices or households you collect personal information from The type of personal information you collect
Technical compliance under CCPA and CalOPPA
To comply with the CCPA and CalOPPA, you must ensure you meet the following requirements in these categories.
General best practices
Complying with the CCPA and CalOPPA largely depends on your ability to adopt best practices and to routinely use them. Some suggestions are to:
Learn about your technological infrastructure: Talk to all stakeholders involved in your business about the sensitive information you collect and where it is stored. Map your applications: Map your applications and create an inventory of the information they use. Create privacy notices: Familiarize yourself with the mandatory notices required by these laws and create them. Investigate third-party vendors: Be hesitant to integrate third-party software until you ensure that they comply with these requirements, too.
Database security
Fulfill these requirements to ensure the highest database security:
Provide users with all personal data you collect about them. Provide the infrastructure to allow consumers to delete their data. Encrypt data whenever possible. Authenticate access to data. Keep track of where you send data and where you collected the data. Keep track of all consumer rights requests and their progress. Apply pseudonyms for consumers when sharing information for research purposes. Conduct periodic audit logs to ensure you are complying with all relevant rules.
Cookies
Under the CCPA, data you collect through the use of cookies is considered “personal information.” Therefore, you must disclose the data you are collecting through cookies and what you are doing with it. You must also give consumers an option to opt out of the sale of this information.
Following the CCPA and CalOPPA
The CCPA and CalOPPA are two broad consumer protection laws that you may have to comply with. Use the tips above to help you meet the laws’ specific requirements and to avoid any compliance issues.
Sources:
How much data is generated each day?, Visual Capitalist How businesses are collecting data (and what they’re doing with it), Business Daily News 5 real-world examples of how brands are using big data analytics, Mentionlytics Few consequences for health privacy law’s repeat offenders, ProPublica How Ashley Madison data breach ended marriages, ID Strong Consumer protection law: The basics, FreeBackgroundChecks California Consumer Privacy Act (CCPA), State of California Department of Justice Data security, NIST NCCoE
