Calendrz California Consumer Privacy Act (CCPA)

 

This information is provided “as-is.” Information and views expressed in this topic, including links and Internet Web site references, may change without notice. You bear the risk of using it. This has been created as a general guide and should not be construed as legal advice. You should consult with your own legal professionals regarding any legal questions you have.

 

What is the CCPA?

 

The California Consumer Privacy Act (CCPA) is the first comprehensive privacy law in United States. It was signed into law at the end of June 2018 and went into effect on January 1, 2020 and provides a variety of privacy rights to California consumers. Businesses regulated by the CCPA will have a number of obligations to those consumers, including disclosures, General Data Protection Regulation (GDPR)-like rights for consumers, an “opt-out” for certain data transfers and an “opt-in” requirement for minors.

 

Who needs to know about the CCPA?

 

The CCPA only applies to companies doing business in California, which annually satisfy one or more of the following: (1) have a gross revenue of more than $25 million, (2) derive 50% or more of its annual revenue from the sale of consumer personal information, or (3) buys, sells, or shares the personal information of more than 50,000 consumers.

 

When will the CCPA come into effect?

 

The CCPA went into effect on January 1, 2020. Enforcement by the California Attorney General (AG) began July 1, 2020.

 

How will the CCPA affect Calendrz?

 

Many of the CCPA’s rights afforded to Californians are similar to the rights the GDPR provides, including the disclosure and consumer requests similar to data subject right (DSR) requests, such as data access, deletion, and portability. As such, customers can look at our existing GDPR data subject right requests procedures to help them with their CCPA related requests and should review our Privacy Policy.

 

 

What rights do customers have under the CCPA?

 

The CCPA requires regulated businesses that collect, use, transfer, and sell personal information to, among other things:

  • Provide disclosures to consumers, prior to collection, regarding the categories and purposes of collection.
  • Provide detailed disclosures in a privacy policy regarding the sources, business purposes, and categories of personal information that is collected, including how those categories are sold or transferred to other entities.
  • Enable Consumer rights relating to access, deletion, and portability of the specific pieces of personal information that has been collected by you.
  • Enable a control that will permit consumers to opt out of the “sale” of the consumer’s data. However, certain transfers, like transfers to service providers, remain permitted.
  • For minors, under 16, enable an opt-in process so that no sale of the minor’s personal information can occur without actively opting in to the sale.
  • Ensure that consumers are not discriminated against for exercising any of their rights under CCPA.

 

What are the CCPA required disclosures?

 

The CCPA requires disclosure of the following:

  • Categories of personal information of the consumer that have been collected.
  • Categories of sources used in collection.
  • The business or commercial purposes for collecting.
  • The categories of third parties with whom the personal information is “shared”.
  • Categories of personal information that has been “sold” and the categories of “third parties” to whom each category of personal information was sold.
  • Categories of personal information that has been “disclosed for a business purpose” (that is, transferred but not a “sale”) and the categories of “third parties” to whom each category of personal information was
  • The specific pieces of personal information that has been collected about that consumer.

 

How is data “sold” under the CCPA?

 

Calendrz does not sell our customers data.

The definition of “sell” in the CCPA is incredibly broad, including “making personal information available to” a third party for monetary or other valuable consideration. Where a consumer has elected to “opt-out”, the business will be required to turn off the flow of personal information to any third party.

The CCPA does provide a number of carve-outs to this “sale” opt-out control. The three primary carve-outs are transfers (i) to a Service Provider, (ii) to an “exempted entity” or “contractor”, and (iii) at the direction of the consumer. Even if a consumer has elected to “opt-out”, personal information can continue to transfer to third parties who fit into those carve-outs.

 

What do Businesses and Service Providers mean in the context of CCPA?

 

In the context of CCPA, Businesses are individuals or entities that determine the purposes and means of the processing of consumer’s personal data, and Service Providers are individuals or entities that process information on behalf of a business. These are broadly synonymous with the terms Controllers and Processors used in GDPR.

 

What is Calendrz doing to achieve CCPA compliance?

 

Calendrz has implemented GDPR-related DSRs globally and we have adjusted our Terms of Use and Privacy Policy to align with CCPA requirements. We have also reviewed our third-party data sharing agreements and taken steps to establish that the necessary contractual terms are in place to ensure that we do not “sell” personal information.

What specifically is deemed personal information?

 

Personal information is any information relating to an identified or identifiable person. There is no distinction between a person’s private, public, or work roles. The defined term “personal information” roughly lines up with “personal data” under GDPR. However, CCPA also includes family and household data.

Examples of personal data include:

 

Identity

 

  • Name
  • Home address
  • Work address
  • Telephone number
  • Mobile number
  • Email address
  • Passport number
  • National ID card
  • Social Security Number (or equivalent)
  • Driver’s license
  • Physical, physiological, or genetic information
  • Medical information
  • Cultural identity

 

Finance

 

  • Bank details / account numbers
  • Tax file number
  • Credit/Debit card numbers
  • Social media posts

 

Online Artifacts

 

  • Social media posts
  • IP address (EU)
  • Location / GPS data
  • Cookies

 

How does the CCPA apply to children

 

  • CCPA introduces parental consent obligations consistent with The Children’s Online Privacy Protection Act (COPPA) for children under the age of 13.
  • For children between 13 and 16 years old, CCPA imposes a new obligation to obtain opt-in consent from the child for any “sale” of their personal information.
  • For the use of our Services by educational institutions and service providers, please see our COPPA Privacy Policy.