CCPA vs GDPR | DataGrail

CCPA vs GDPR

Does the US have anything like GDPR? Has privacy regulation that businesses are subject to doubled, or are the new regulations following GDPR similar to it? Here is what you need to know about California’s CCPA vs Europe’s GDPR.

CCPA

What is the CCPA?

Only two months after the GDPR went into effect in May of 2018, the California legislature passed the CCPA ( full original text), a new privacy bill largely based on the GDPR. The quick turnaround on the bill was enabled by growing popularity around a ballot initiative started by Californians for Consumer Privacy. Since 2018, the CCPA has gone through many revisions ( find the final text here) amid public hearings and lobbying by businesses, though many of the core requirements and consumer rights remain untouched. At a high level, the CCPA requires businesses to adhere to certain consumer privacy practices and grants customers the right to request or delete their data from businesses and send businesses a request to opt out of their data being sold.

Who does the CCPA apply to? Who must comply with the CCPA?

The CCPA has an extraterritorial reach. It applies to businesses that collect personal information from California consumers and do business in California for profit or for the financial benefit of shareholders in California and meet one of three minimum thresholds, regardless of whether they have an office or any other physical presence in the state or not.

The CCPA has three thresholds businesses must meet in order to fall under the statute. To be within the scope of the statute they must fall under one or more of the following situations:

  1. Have in excess of $25 million in annual gross revenue or
  2. Buy, receive for a commercial purpose, sell, or share for a commercial purpose, the personal information of 50,000 or more consumers or households or
  3. Derive 50 percent or more of their annual revenue from selling consumers’ personal information.

As a result, small businesses in large part are exempt from compliance, and businesses do not need to collect information directly from California consumers to be covered. If consumer data is collected on their behalf by a service provider or other third party and the other criteria are satisfied, businesses could fall under the statute.

What data is covered by the CCPA?

The CCPA governs consumer rights with regard to various aspects of consumers’ personal information. Under the law, “personal information” is not necessarily restricted to traditional notions of “sensitive information” or “personally identifiable information.”

GDPR

What is the GDPR?

GDPR fundamentally reshaped how companies collect and process personal data, and it’s crucial to understand how personal data is treated under this regulation. Personal data has become a broad term, and in the regulation, refers to a wide range of rights granted to individuals regarding their data. A data subject’s rights include access to their own data, the ability to correct inaccuracies and restrict the use of their data as well as the right to be forgotten. With all these rights granted to the EU citizen, it’s an absolute necessity for businesses to quickly access and manipulate data sets.

In conjunction with understanding GDPR, businesses must also recognize their role as either a data controller or processor. Under GDPR, a data controller and processor have different regulations to follow, and in certain cases, a business can be both the controller and the processor. The controller’s role is to determine the purposes and means of processing data, while a processor simply works with the data on behalf of the controller. Further, controllers primarily interface with data subjects and must respond promptly to requests from the subjects by providing necessary information and acting on the data. Then, processors assist the controller in deleting, manipulating, or sharing a subject’s data.

Who Does the GDPR apply to?

The GDPR applies to companies or entities that process personal data and either have an established branch in the EU or offer products or services (paid or free) to the EU resident. Although this will include practically any company that sells to the EU resident, not all obligations of the GDPR are applied to small and medium enterprises if they do not process consumers’ personal information as a core part of their business.

What are the 7 principles of GDPR?

The GDPR sets out to fulfill 7 key principles, stated early in the legislation that provide a purpose for the 99 articles that follow. Compliance with the principles is key to building a privacy program for a company and integrating these principles into a company is part of data mapping and creating privacy by design.

  1. Lawfulness, fairness and transparency

    • Identify valid grounds for collecting and using personal data (known as lawful basis)
    • Use personal data in a fair manner; do not process the data in a way that could be detrimental, unexpected, or misleading to the individual
    • Communicate openly and honestly with users from the first contact about how their personal data will be used

  2. Purpose limitation

    • State clear purposes for processing data
    • Record and document the purposes for processing data and specify them in privacy information for users ( DataGrail’s data privacy policy)
    • Personal data can only be used for new purposes if it is compatible with the originally stated purposes or consent is given by users

  3. Data minimisation

    • Ensure personal data processed is:
      • Adequate and sufficient to fulfill the purpose
      • Relevant – has a link to the purpose
      • Limited – excess data is not retained and necessary data is not kept past when needed

  4. Accuracy

    • Take all reasonable steps to ensure personal data kept is correct
    • Depending on use, personal data may need to be updated regularly
    • If personal data is identified as incorrect or misleading, it must be correct or erased

  5. Storage limitation

    • Personal data must not be kept longer than necessary
    • Companies must be able to justify how long they keep personal data, which will depend on the purpose of collection and holding
    • Wherever possible, a policy setting standard for retention periods should be in place, with documentation
    • Individuals have the right to have data deleted if it is no longer needed
    • Data kept should be periodically reviewed, and erased or anonymized if no longer needed

  6. Integrity and confidentiality (security)

    • You must ensure that you have appropriate security measures in place to protect the personal data you hold.

  7. Accountability

    • The accountability principle requires you to take responsibility for what you do with personal data and how you comply with the other principles.
    • You must have appropriate measures and records in place to be able to demonstrate your compliance.

Enforcement Overview

Top 5 violations with the highest sum of GDPR fines:

Highest individual GDPR fines:

  1. British Airways, UK, July 8, 2019 - € 204,600,000 (Insufficient technical and organisational measures to ensure information security)
  2. Marriott International, UK, July 9, 2019 - € 110,390,200 (Insufficient technical and organisational measures to ensure information security)
  3. Google, France, Jan 21, 2019 - € 50,000,000 (Insufficient legal basis for data processing)
  4. TIM (telecommunications operator), Italy, January 15, 2020 - € 27,800,000 (Insufficient legal basis for data processing)
  5. Austrian Post, Austria, October 23, 2019 - € 18,000,000 (Insufficient legal basis for data processing)

CCPA vs. GDPR Summary