The CCPA: Keeping Your Data Safe

Table of Contents:

1. The Data Marketplace
2. New Data Rights
3. Will it Affect Me?

On January 1st, America’s first broad data privacy law went into effect. The California Consumer Protection Act (CCPA) entitles Californians to certain rights that will affect how companies collect and distribute their personal information. It represents a major milestone for data privacy and a potential sea change for an industry that had gone unregulated for decades.

The Data Marketplace

Seniors learned just how dubious the data marketplace can be during the 2016 election cycle. Political consulting firm Cambridge Analytica collected data from more than 85 million Facebook profiles and shared the information with both the Donald Trump and Ted Cruz campaigns. Few received any notification that their data had been collected, but an overwhelming number received targeted advertisements in the leadup to the election. For many Americans, this episode provided an introduction to the very concept of personal data privacy.

23andMe presents another recent cautionary tale. In 2018, Scientific American reported that the ubiquitous DNA testing company was providing genetic information to drug giant GlaxoSmithKline. The partnership had noble goals — it was intended to help drug development — but it still necessitated sharing data from millions of Americans without their consent.

While these are fairly extreme examples, they underline the power imbalance inherent to the data marketplace. Prior to the CCPA’s passing, California seniors were at the mercy of organizations who could potentially use personal data to target them with misleading information or, at the very least, profit off of this personal data in secret.

New Data Rights

The CCPA’s introduction lists the five personal data rights it will ensure for all Californians:

1. The right to know what personal information is collected about you. Under the CCPA, a business must tell you that it is collecting your information either before or during the collection process. The law applies a broad definition to the term “personal information,” covering everything from names to search histories.
2. The right to know whether your personal information is sold or disclosed and to whom. Under the CCPA, businesses must disclose the type of organizations they intend to share your information with before they share it. They are not required to disclose the names. It is also up to the consumer to ask for these details in the first place and formally request that companies not share their personal data. Some companies are making this more challenging than others. The Washington Post’s Geoffrey Fowler notes that one organization even asked him to mail his request by notarized letter. Fowler is one of several experts to criticize this aspect of the CCPA. While it provides some additional consumer protection, it still places a significant burden on the consumer to safeguard their own data.
3. The right to stop companies from selling your personal information. Businesses must provide California residents with an opportunity to opt out of having their personal information sold or shared. They must honor these requests and include information about opting out on their websites. Vox’s Sara Morrison points out that, like #2, this right has serious limitations. Consumers can stop companies from selling their data, but there’s no way to opt out of having that data collected in the first place. That means it’s more or less business as usual for Facebook, Google, and the other titans of data collection.
4. The right to access your personal information. All California businesses must offer opportunities for consumers to access the personal data they’ve collected. Within 45 days of your request, a business has to tell you what they’ve collected, where they got it, why they collected it, and the types of companies they’ve shared it with — free of charge. You can also take this opportunity to request they delete the information.
5. The right to equal services and pricing, even if you exercise your privacy rights. California companies cannot charge consumers more or offer a different level of service because they’ve chosen to exercise their rights. They can, however, continue offering incentives to consumers that do provide personal information. Loyalty programs, for example, would not be considered discriminatory under the new law.

Will it Affect Me?

Though California’s in the name, the CCPA can help seniors in every state take control of their data privacy. Organizations including Amazon, Apple, Facebook, Google, and Twitter accept CCPA requests from all Americans.

California may even turn out to be a trendsetter when it comes to data privacy. Other states are already at work on bills of their own and the federal Consumer Online Privacy Rights Act has drawn support from both parties and both houses of Congress.