CCPA Data Collection: What Do You Need to Know?

The CCPA affords users a whole host of new rights that include the right to transparency related to data collection, right to be forgotten, right to opt out of having their data sold or shared, as well as the opt in requirement in case of minors.

Privacy regulations drive organizations to be responsible custodians of their consumers' data. California Consumer Privacy Act (CCPA), recently amended by the California Privacy Rights Act (CPRA) 2020 - requires organizations to follow CCPA guidelines when dealing with California residents’ data. In this blog, we will discuss data collection techniques compliant with CCPA.

Impact of the CCPA

Before the CCPA was drafted, the GDPR was already in effect, and big organizations such as Facebook and Google faced billions in fines due to non-compliance. Experts believe that the adoption of the GDPR by multinational corporations was, therefore, easier than the CCPA as organizations had already spent a lot of money and effort in building privacy programs geared towards GDPR compliance and then tried to adapt those to also comply with the CCPA.

The CCPA was also the first legislation in the US that gave consumers more control over how companies collected and used their personal data.  Due to the economic landscape of the State of California and the presence of most of the internet industry in Silicon Valley, the CCPA was catapulted into prominence since it not only affected the entire US economy but had an almost global effect.

Mr. Reece Hirsch, co-head of Morgan Lewis’ privacy and cybersecurity practice, says “If you thought the GDPR was bumpy, the CCPA is going to be a real roller coaster”.

Xavier Becerra, California Attorney General, says, ”Even though widespread enforcement of the CCPA isn’t likely until July, companies should not view the first six months of the year as a grace period. We’re going to try to help folks understand our interpretation of the law”.

Following are some of the aspects that impacted businesses under the CCPA:

1. Fines: The penalty of non-compliance is much more strict under the CCPA. Where the GDPR had an upper cap on penalties, the CCPA has no ceiling and fines are assessed per violation.
2. Cost: According to the economic impact assessment report, the total cost of initial compliance with the CCPA is estimated at $55 billion.

The CCPA has sent shockwaves across the entire data privacy landscape and in order to stay in compliance, organizations are going to need a specific tool which can help them perform all CCPA requirements swiftly and with ease. We will talk about this solution further in the article, but let's first see what the CCPA entails.

Data Rights under CCPA

About 40 million consumers who are provided rights under the CCPA. These rights include:

1. Right to awareness:

Covered entities are required to disclose the personal data collected, sold, shared, or disclosed about consumers for a business or commercial purpose and inform all consumers about their rights under the CCPA and the method to exercise those rights in their privacy policy.

2, Right to be provided notice at the point of collection:

It is also essential for organizations to inform consumers of the categories of data collected and the purpose of processing at or before the time of collection.

3. Right to access:

Organizations are required to provide individuals with access to their information upon receipt of a verified request.

4. Right to deletion:

Organizations are obligated to delete an individual's personal data upon request. In case this data is shared with third-party vendors, the data held in those systems needs to be deleted as well.

5. Right to Opt-out:

Organizations need to provide consumers with the ability to opt-out of the sale of their personal data by providing easy-to-use and prominent links titled "Do Not Sell My Information" on their website. An organization cannot ask a consumer to opt back into the sale of their personal data for at least a 12 month period from the exercise of opt-out and a third party which bought the personal data of the consumer must provide an opportunity for the consumer to opt-out before further selling that personal data to another party.

6. Right to not be discriminated:

A company covered under the CCPA cannot discriminate against an individual who exercises their CCPA rights.

7. Right to Sell:

Organizations are allowed to offer financial incentives to consumers, for the sale/collection of their personal information. Consumers should at all times be able to revoke this permission and request deletion of all previously collected or sold confidential information.

8. Right to Opt-in:

Personal Data containing minors' personal information cannot be sold by a business unless the minor (age of 13 to 16 years) or the Parent/Guardian (if the minor is aged below 13 years) opt-in to allow this sale. Organizations can be held responsible for the sale of minors' personal information if they either knew or willfully disregarded the consumer's status as a minor and the minor or Parent/Guardian had not willingly opted in.

9. Right to multiple request mechanisms:

Businesses must provide consumers with a minimum of two designated methods/channels for submission of consumer requests for personal information disclosure, including a toll-free number. Companies that exclusively operate online and have a direct relationship with their consumers may provide an email.

CCPA Notice at or before the point of Data Collection

One very important requirement under the CCPA is the notice that has to be provided to consumers at the point of CCPA collection of their personal data - Organizations cannot collect personal data unless they provide consumers this notice. If the business intends to collect additional categories of personal information, the business shall provide a new notice at the point of collection.

Described in detail in the CCPA the notice should must be conspicuous and easy to understand and it must be made available at or before the point of collection of personal data:

1. When a business collects consumers' personal information online, it may post a conspicuous link to the notice on the introductory page of the business's website and on all web pages where personal information is collected.
2. When a business collects personal information through a mobile application, it may provide a link to the notice on the mobile application's download page and within the application, such as through the application's settings menu.
3. When a business collects consumers' personal information offline, it may include the notice on printed forms that collect personal information, provide the consumer with a paper version of the notice, or post prominent signage directing consumers to where the notice can be found online.
4. When a business collects personal information over the telephone or in-person, it may provide the notice orally.
5. Businesses must provide consumers with certain information in a “notice at collection”. The CCPA requires businesses to disclose the categories of personal information they collect and how they use that information.

Manual methods make it virtually impossible for organizations to offer a notice at the point of data collection and then keep track of all the notices sent out. It is advised that organizations should have a single solution that can manage all these data collection requirements to make the process smoother.

Data Collection Notice Compliance Checklist

The notice at or before the point of collection should have the following information:

1. A list of the categories of personal information about consumers is to be collected. Each category of personal information shall be written in a manner that provides consumers with a meaningful understanding of the information being collected.
2. The purpose(s) for which the categories of personal information will be used.
3. If the business sells personal information, the link titled “Do Not Sell My Personal Information” for consumers to be able to opt-out (for offline notices a link to the website of the company can be offered or a checkbox on the data collection form).
4. A link to the business's privacy policy, or in the case of offline notices, where the privacy policy can be found online.

CCPA Privacy Policy Requirements

The CCPA requires organizations to have a clear privacy policy to ensure compliance. Organizations are required to update their Privacy Policy at least every 12 months to ensure that it is current. In case a material change has been made, the organization is required to provide an update notice of these changes to the consumer.

Following are the key requirements of a CCPA compliant privacy policy:

1. What information does the organization collect
2. Why the organization collects this personal data at all
3. Who the organization may share this data with, and why
4. How the organization collected the data
5. Who the consumer can contact if they wish to know more about how their data is used or stored
6. The consumer's various rights

Opt-Out and CCPA

Organizations complying with the CCPA data collection must allow consumers to opt-out of the sale of their personal data by adding a “Do Not Sell My Personal Information,” link on their website. This should enable users to opt-out of the sale of their data. This link should be simple to read and understandable for consumers.

Once a customer has opted out, organizations need to make sure the following steps are met:

1. Consumers should not be sent any further marketing communications and should not be contacted to opt-back into marketing.
2. Delete consumer's personal data, which was collected for the purposes of sending marketing messages.
3. Stop the use of any profiling data relating to that user and remove any profiling data of the user.
4. Do not unduly postpone or delay an opt-out request. Honor opt-out requests promptly.
5. Do not re-ask the consumer for consent for a 12 months time period.
6. Do not discriminate against consumers who have opted out.

Keeping track of consent can be a tedious process that is tedious and time-consuming if done via manual methods. Organizations need a solution that can keep track of all this data and catalog them as per their category and nature, in order to streamline their processes.

How can organizations comply?

The CCPA is a difficult law to comply with if your organization does not have the right tools to fulfill its requirements. In order to comply with ease, organizations need a data discovery tool that can help them keep track of all the data they collect and then act according to the regulation.

There are several functionalities that every solution should have if it aims to offer efficiency and compliance with global privacy regulations such as the CCPA. The evolving paradigm of data translates to better security practices and improved privacy for the consumer and organizations. Following are the functionalities that a CCPA Compliance tool needs to have.

1. Data Linking Automation

The core of any smart data linking automation solution is artificial intelligence and machine learning. What this means is that machine learning and automation is paired with artificial intelligence to stitch ‘people data graphs’ to give a complete and holistic picture of when, where, why, and how personal information of customers were collected, stored, shared, and used. This helicopter-level visibility, so to speak, translates to time-saved sorting and linking personal data of consumers which can then be utilized for other operational processes.

2. DSR Fulfillment Automation

Personal data linking with the help of artificial intelligence and robotics is already helping enterprises scale their DSR response times multiple folds with minimal cost increases. DSR fulfillment automation will mean that the steps taken and the man-hours put into fulfilling each data subject request are significantly cut down.

3. Internal Assessment Automation

Privacy assessment can be simplified but it would require a system of record, a system of knowledge, a system of engagement, and a system of automation. These systems, when used effectively, can make it easier for stakeholders to collaborate and complete assessments, as well as share the reports with external parties under one secure platform.

4. Vendor Assessment Automation

Assessing vendors before partnering up is empirical to thrive in an era of strict data privacy regulations as even the smallest let up in controls, be it by a vendor, can severely dent an organization’s credibility. In order to alleviate the risk, a system of vendor assessment based on artificial intelligence and automation is necessary.

5. Automated Consent Lifecycle

An effective consent management platform should offer the following:

• • Policy Notification and Collection of Consent
  • Propagation Management
  • Mapping and Correlation
  • Tracking, Governing, and Managing Consent

6. Built a graph between data and its owners

Automatically link personal data with their owners in all structured and unstructured data systems. In complex unstructured data systems, data discovery tools can identify documents or files that contain an individual’s personal information.

7. Data Mapping

A good data mapping solution supports the organization’s privacy compliance requirements by allowing it to collaboratively gain full visibility into the flow and control of personal data—not just within the organization but also outside its boundaries.