The California Consumer Privacy Act of 2018 (CCPA or “the Act”) is one of the most significant pieces of privacy legislation that we have seen in the United States. Signed into law on June 28, 2018, and effective as of January 1, 2020, the CCPA will force many businesses to change how they manage and sell consumer information. More specifically, the Act requires businesses to observe restrictions on data monetization, accommodate rights to access, deletion and porting of personal data, update privacy policies and prepare for added penalties and liquidated damages. The International Association of Privacy Professionals estimates that the Act will apply to more than 500,000 companies, the majority of which are small to medium-sized enterprises. Although the CCPA is a state and not federal law, it will apply to companies located throughout the United States, including many Illinois companies that do business in California.
How Will the California Consumer Privacy Act (CCPA) Apply to Businesses in Illinois?
The CCPA will apply to Illinois businesses that collect consumers’ personal information, along with Illinois businesses that sell consumers’ personal information or disclose it for a business purpose. The Act defines the term “business” as a legal entity that is organized for the financial benefit of its owners and that collects personal information or determines the purpose and means of processing consumer personal information. Additionally, to fall within the jurisdiction of the CCPA, an Illinois business must be doing business in California and meet one of the following conditions:
- Annual gross revenue in excess of $25 million
- Buys, receives, sells, or shares the personal information of 50,000 or more consumers, households or devices
- Derives 50% or more of its annual revenue from selling consumer personal information.
The CCPA goes on to define “consumer” as a natural person who is a California resident, and “personal information” as any information that identifies, relates to, describes, or is capable of being associated with a particular consumer or household.
Based on the criteria outlined above, the CCPA will undoubtedly apply to many business operating in Illinois. Although it does not go into effect until January 2020, it is important that businesses determine now whether this important privacy bill will apply to them, so they can take the steps to adequately prepare for its implementation.
If you have any questions regarding the California Consumer Privacy Act, or any other privacy or cyber security matters, please contact Tim Hayes at McKenna Storer.