Glossary to the CCPA
To get oriented to the California Consumer Privacy Act, the CCPA, it's good to have a grasp of the basic jargonese and concepts around it. Here's a quick glossary to help navigate the basic terms involved with this landmark privacy data protection legislation. Enjoy!
Anti-discrimination
A business can't discriminate against a consumer for exercising their CCPA rights, but may charge different prices or provide a different quality of goods/services if the difference is related to the value provided by the consumer's data.
California
The fifth-biggest economy in the world, home to the world's leading tech giants, and a traditional wellspring of tech-related trends and regulation for the U.S. and abroad. Its sheer size and number of online consumers mean nearly all marketers anywhere need to consider CCPA compliance.
CalOPPA
The California Online Privacy Protection Act, launched in 2003. Initially centered on personally-identifiable information (PII), it required websites and online services to display Privacy Policies. Its scope broadened in recent years, and the CCPA is a further extension to give consumers more control over their data.
CCPA
The California Consumer Protection Act (CCPA), the first U.S. attempt at a comprehensive data protection law, and likely to be a template for legislation and regulation in other states and even (potentially) for eventual federal legislation.
CCPA Amendments
Multiple proposed bills would add new provisions to supplement the CCPA, addressing areas including data brokering, facial recognition technology, social networking services, disclosing the monetary value of consumer data, and more. None of the proposed changes, however, provide grounds for a business to delay compliance.
Consent
Unlike the GDPR, the CCPA does not require websites or online services to obtain opt-in consent before collecting personal data (unless a consumer is under 16) or to provide users a means to opt-out of collection.
Copycat Laws
Hawaii, Maryland, Massachusetts, Mississippi, New Mexico, and Rhode Island have proposed laws largely identical to the CCPA. Other states have laws with key similarities but more pronounced differences. A total of (as of right now) 15 state laws are under consideration, with more likely.
Deletion
When a consumer makes a verifiable deletion request, a business must delete personal data collected about that consumer, and direct its service providers to follow suit.
De-Identified Data
Under the CCPA, this means data that's stripped of identifying qualities, "anonymized" so businesses and marketers can safely use it. This data must be incapable of being later re-identified with users, and businesses must put procedures in place to prevent re-identification.
Household
A household, under the CCPA, is defined as a collective of individuals - like a family or occupants at a residential address. Households and individuals are treated the same when it comes to data identification: Using data to narrow a list of consumer identities to a single household is seen as being the same as being able to identify an individual.
Opt-Out
A consumer has the right to opt out of the sale of their personal data, and a business must provide notice to consumers that they sell that data. A related requirement: the business' website homepage must have a "Do Not Sell My Personal Information" link to a web page where consumers can opt out.
Penalties
Violations of the CCPA would be enforced by the California Attorney General's office, which can seek civil penalties of $2,500 for each violation or $7,500 for each intentional violation after A) notice and B) a 30-day "opportunity to cure" period have been provided. But enforcement will be delayed until six months after publication of the A.G.'s implementation guidelines or July 1, 2020, whichever comes first.
Personal Information
Broadly defined as any type of data that identifies an individual or might be linked to an individual or household; it also includes non-identifying data, such as behavioral and transactional behavior on a website, and even the insights and inferences drawn from that data, such as assigning buyer personas or segmentation.
Processing
"Processing" data under the CCPA refers to collection, possession, or other handling of data, whether manually or via automation; the data a consumer enters on a form is processed, just like that collected using cookies. Certain types of data are excluded, but both businesses and service providers are liable for non-compliance with processing protections.
Right of Data Portability
When it's requested, a business must provide personal information in a readily useable format to enable a consumer to transmit the data from one entity to another without hindrance.
Right of Disclosure or Access
Consumers have a right to request disclosure of their personal data and to receive additional details regarding the personal data a business collects and its uses, including any third parties with it shares data.
Selling Data
This includes a wide span of transactions involving the renting, transfer, or trade of private consumer data. Money doesn't have to be exchanged, however: any compensation or benefit the seller receives may violate the CCPA's terms if the data "sold" belongs to consumers who have opted out. So marketers need to stay compliant on all fronts when sharing data.
Service Provider
A "service provider" means a specific type of vendor whose contract states how they can use consumer data; ad agencies and martech firms, for instance. They're prohibited from retaining consumer data once they've delivered services for their client. This limitation still allows the client's business to share that data with other vendors, though.
Third Party
Defined as any organization other than the first-party business that's gathering data through consumer interaction, or service providers receiving consumer data from a company to fulfill its business goals. These are usually data brokers, and if a large number of consumers opt out of selling data, this will make third-party data less available and less attractive to marketers.
View original content here
Related CCPA News: