In June, California enacted what has been seen as one of the most far-reaching consumer protection privacy laws in the nation. The California Consumer Privacy Act (CCPA), which goes into effect on January 1, 2020, was signed into law on June 28 by Governor Brown as a response to a growing concern that consumers need stronger means to protect their personal information — in part due to recent data breaches as well as other privacy incidents that have affected millions.

The CCPA will impose a range of new requirements on businesses with the end goal being to ensure consumers enjoy “choice and transparency” when it comes to their personal information.

“This California Consumer Privacy Act creates important and new obligations to businesses — regardless of where they are located — that serve California residents or whose websites and mobile apps draw from California residents and collect their information,” said Chris Olson, CEO of The Media Trust, a digital vendor risk management firm.

“In the digital economy, that could be most businesses with an Internet presence,” Olson said.

For those in California, or who do business with clients and/or customers in California, this is a truly big deal, and not something any business should think they are above.

“To stay compliant, enterprise websites and mobile apps will need to provide a separate track for users who are California residents,” Olson added. “And when requested by any California-resident users, they will be required to provide within 45 days whatever types and pieces of personal information they’ve gathered. Moreover, this act makes it easier for consumers to sue companies following a data breach, so companies will need to put in place better security practices and procedures to prevent those breaches from happening, or at the very least minimize their impact.”

User Control

CCPA has already been somewhat controversial, as many critics contend it was a hastily-passed law that only came about as part of a deal brokered by the state’s Legislature and Governor as a way to avert what could have been a costly fight over a proposed ballot initiative. That proposal, which was backed by the state’s privacy activists, could have resulted in an even more stringent measure appearing before California voters in November.

As passed, CCPA grants residents in California the right: (1) to know what personal information is being collected about them; (2) to know whether their personal information is sold or otherwise disclosed and to whom; (3) to say no to the sale of their personal information; (4) to access their personal information and request deletion under certain circumstances; and (5) to receive equal service and price, even if they exercise their privacy rights.

So far, it is unclear how this will actually be enforced but those violating the law could face fines ranging from $100 to $750 per consumer per incident. More importantly, CCPA also empowers the state’s Attorney General to pursue cases against businesses for damages of up to $7,500 per violation for what has been described as “intentional violations.”

The question, of course, becomes whether all California-based businesses need to be worried about CCPA? The short answer for quick lube operators is probably not to worry, but it is something that experts say they still need to think about.

“This isn’t really bad for business,” said Michal Priem, CEO of Modern Impact, an analytics research firm. “Most honorable brands — and that includes most major national companies — typically have good intentions about how they collect consumer data.”

This data can include phone numbers and email addresses and other personal information, and CCPA is about making sure this data isn’t sold to third parties. The law also makes it clear how companies notify or contact the customers that provide that data.

“CCPA is simply about what data is being collected,” Priem said. “Consumers already have good reason to be worried about how their data is being collected and then used. What this law is really about is ensuring that consumers are given the ability to opt in or out, and about providing fair language and not a lot of legal terms consumers may not understand.”

On the surface, it might sound like most businesses might never be affected by CCPA, but as has been seen with many regulations, what starts in California has a tendency to migrate to other states.

“Given consumers’ growing wariness of data breaches and leakage, businesses only have to look to a myriad of emerging state initiatives to understand what’s coming,” Olson said. “It’s possible that the CCPA could set the stage for federal data privacy legislation if staying compliant with 50 different laws becomes too cumbersome for businesses.”

For those businesses in California, it is simply a matter of ensuring that consumers understand how their data is used.

“As we’ve seen, most national chains across industries understand this, and this is why we’re all seeing those new user agreements in our email inboxes,” Priem said. “For those smaller businesses, it is just making sure that the data is protected and not used in ways consumers don’t want. This is a law everyone should understand.”

How the European Union’s GDPR Could Affect You