California Consumer Privacy Act of 2018: New Statute Introduces Privacy Protections for California Consumers and Subjects Businesses to Potential Liability

Sullivan & Cromwell LLP - July 2, 2018

On June 28, 2018, California enacted the California Consumer Privacy Act (“CCPA”), which will take effect on January 1, 2020. The Act applies to all organizations that conduct business in California and satisfy one of several commercial activity thresholds. The Act expands the definition of personal information; creates several categories of new privacy rights; imposes special rules for the collection of consumer data from minors; exposes businesses that fail to implement reasonable data security to liability for loss of unencrypted/non-redacted personal information; and establishes a public enforcement framework with statutory damages. The CCPA has significant implications for all covered businesses that collect, disclose, or sell consumers’ personal information, including transactions where the disclosure is both inherent and incidental. Businesses that are potentially subject to the Act should begin preparing and implementing a plan for compliance as soon as possible.