Companies Know California Privacy Law Goes Into Effect by Jan. 1, but Little Else

Companies have less than five months before California’s landmark privacy law, which has the power to reshape the way American companies do business, goes into effect. But there’s a big problem: There's no clear model for how to comply or who exactly is subject to the rules.

Starting Jan. 1, California residents will be able to opt-out of the sale of their personal information and also request to see the data collected about them from companies that meet specific revenue or collection thresholds. Companies then have 45 days to respond to such inquiries.

However, as the California Consumer Privacy Act is written now, both privacy consultants and legal experts are concerned that a wide range of issues -- such as vague definitions and mechanism descriptions regarding how firms should collect and share data -- could make accurately responding to those requests impossible. And experts note it doesn’t help that the state attorney general’s office has until July 1, six months after enactment, to lay out how it plans to enforce the law.

Scott McDonald, chief executive officer and president of the Advertising Research Foundation, a nonprofit industry association, likened it to the Internal Revenue Service failing to publish detailed regulations for a new tax law. “People then say, ‘I want to pay my taxes and be a good citizen, but how am I supposed to do that if it’s not spelled out in detail?’”

The California Consumer Privacy Act -- which was revived and passed within a week during last summer’s legislative session -- mandates that companies that bring in $25 million in annual revenue; collect at least 50,000 pieces of information from California residents, households or devices; or derive more than 50 percent of their business by selling consumer data must be in compliance by next year.

But some experts are worried that the law fails to explicitly define covered entities, which makes it unclear whether the threshold of $25 million in annual revenue refers to income from business conducted in California, the United States or globally. And others are concerned about the lack of clarity on how state Attorney General Xavier Becerra’s office expects companies to share user information with consumers.

Jim Halpert, the Washington-based global head of the cybersecurity practice at law firm DLA Piper, said given these ambiguities, it’s impossible for any company to reach 100 percent compliance with the state’s forthcoming privacy law as it currently stands.

Halpert, who has represented clients in major security and privacy cases in both the federal courts and before the Federal Trade Commission, said the largest issue is that it’s unclear which data sources companies need to pull from to successfully fulfill a consumer’s request to either look at the data stored about them or delete it. For example, a brick-and-mortar store might collect information about a customer during online transactions, through interactions with a customer-support phone call, video surveillance at physical retail locations, and third-party email marketing companies hired to reach current and potential customers.

Under CCPA, Halpert said it appears as if companies will need to pull together all of this information to give to a consumer -- which is tricky given the nature of how it’s stored -- but the law doesn’t clarify if that’s actually the case. And Halpert added that state lawmakers aren’t expected to clear up vague definitions and expectations this year, with those in Sacramento gearing up to battle over possible last-minute amendments that could water down the law’s overall scope.

“The ambiguities are just not a high-enough priority for the different sides in the discussion in Sacramento,” he said.

Becerra’s office is expected to dole out recommendations this fall on what responses to the consumer data requests could look like, Halpert said. But Jay Cline, PwC’s U.S. privacy services leader, noted companies can’t afford to wait: They need to start working with their IT teams this summer, at the latest, to update data storage systems, to leave enough time for testing before they receive their first consumer data request.

Becerra’s office did not respond to a request for comment.

Cline said he is advising clients to take this time to also focus on establishing a system that is flexible and encompassing enough that only a few tweaks and adjustments are needed if a federal standard is ever handed down. This requires a thorough assessment of current privacy measures to figure out where a company has what Cline calls a “compliance gap,” or the difference between what the company is already doing to collect and store data and what they need to do to comply.

But diving into the process won’t be cheap: Per an analysis from the Information Technology and Innovation Foundation, a tech think tank that supports a federal privacy law that would preempt any state legislation, if a law similar to California’s or the European Union’s General Data Protection Regulation were implemented on the federal level, American businesses overall could anticipate spending $7.2 billion in compliance costs to provide consumers with the right to data access, deletion, data portability and rectification.

And according to a poll conducted by MediaPro, a cybersecurity and privacy training group, in April among 1,004 U.S. employees, 46 percent of those surveyed say they have “never heard” of the California law -- setting up a potential problem for companies that need to train staff members who know nothing about the law but will be expected to assist with consumer data requests or oversee other compliance efforts.