Are You Prepared? Dealing with GDPR-like Rules Spreading Across the Nation

As New York's NYCRR 500 regulations serve as the gold standard for cybersecurity protocols, California's CCPA will likely serve as the U.S. standard for privacy. Like its European GDPR counterpart, California's privacy act establishes consumer rights and corporate responsibilities, which will be enforced with penalties up to $7,500 per violation.

As motivation for the law, the California Act notably cites the tens of millions of people whose personal data was misused by the data mining firm Cambridge Analytica, a greater desire to heighten data privacy controls and transparency of data practices, and the people's desire for privacy and more control over their information. The Act provides specific provisions:

• Full disclosure regarding the collection of personal information, including details of the collected information, sources, the purpose, whether the data is disclosed or sold to another party, and if so, the third party's details.
• An opt-out right to prevent a business from selling their personal information to third parties.
• The right to be deleted (like with GDPR's right to be forgotten).
• The right to equal service and pricing, even if the individual exercises their rights under the Act (the net neutrality of privacy).

The Act mandates traceable transparency of consumer data collection, use, distribution, and the GDPR-like right to be forgotten. These requirements must be made public through general policy, by specific request, and cannot form the basis of bias or discrimination on the part of the business. A company cannot tie goods or services to the ability to resell consumer information or offer discounts or other incentives in exchange for this ability. This moves consumer privacy rights from the domain of often ignored fine print to the front page.