November December CBA Report

T he most significant piece of privacy legislation in the United States to date — the California Consumer Privacy Act of 2018 (CCPA) — is set to go in effect in just a few months, on January 1, 2020. When that time comes, the CCPA will impose a broad set of onerous requirements on compa- nies relating to how they collect, use, disclose and sell consumer personal data. Although the name of the law suggests that the CCPA applies only to companies located in California, the reach of the CCPA will actually extend nationwide. Specifically, any business that collects the personal data of California residents and meets any one of three thresholds will be required to comply with CCPA mandates. This means that many Ohio businesses (including law firms)— even if they have no physical presence in California — will be required to comply with the CCPA once it goes into effect at the start of next year. Determining CCPA Applicability One of the more significant aspects of the CCPA pertains to the broad scope of business entities to which the law applies. For Ohio companies, then, the first matter to address is determining whether the CCPA applies to their operations. The CCPA applies to any business that handles the personal data of California residents and meets any one of three thresholds: 1. Has annual gross revenue in excess of $25 million; 2. Collects, buys or sells the information of 50,000 or more consumers, households or devices; or 3. Derives 50 percent or more of its revenue from the sale of consumers’ personal information. Significantly, a physical presence in California is not a require- ment to fall under the scope of the law. Rather, any company that does business in California — even if the entity is not located within the state’s borders — must comply with the mandates of the CCPA if it handles California consumers’ personal informa- tion and meets any of the three thresholds. Compliance with CCPA If an Ohio business determines that it falls under the scope of the CCPA, that entity will be required to comply with a range of different privacy-related mandates regarding how it utilizes consumers’ personal data in the course of its business opera- tions. Consequently, the business will have to devote a significant amount of time, energy and resources to make the necessary By David J. Oberly Is Your Business Ready for the California Consumer Privacy Act? 8 l November/December 2019 CBA REPORT www.CincyBar.org Feature Article