Insider asked California out of home attorney Richard Hamlin to discuss how the pending California Consumer Privacy Act rules will impact out of home companies. It looks like most out of home advertising companies are too small to have to comply with the act but you need to start paying attention to privacy issues because they aren’t going away. We’ll write more about this during the next month.
By Richard F. Hamlin, Hamlin Cody Law
The California Consumer Privacy Act of 2018 (“CCPA”) becomes effective January 1, 2020. It will affect OOH companies. The Act adds 22 sections to the Civil Code and amends a 23rd section.
Application: The Act applies to “businesses.” It defines “business” as any individual or for-profit entity that does business in California and collects or uses consumers’ personal information, and which:
- Has annual gross revenues in excess of $25,000,000; or
- Buys sells or uses the personal information of 50,000 or more consumers, households or devices; or
- Derives 50% or more of its revenue from selling consumers’ personal information.
If you or your business does not satisfy any of these criteria, the Act does not apply to you. (It’s the sole advantage of having revenue that doesn’t exceed $25,000,000.) You cannot avoid its terms by breaking up your business into smaller entities.
Enforcement: The Act has teeth. If you fail to maintain “reasonable security procedures” you may be liable for damages of $100.00 to $700.00 per incident, or actual damages, whichever is greater. You may also be faced with an injunction and “any other relief the court deems proper.” Any consumer whose personal information is stolen may sue you for these damages.
The attorney general may also sue you for a civil penalty. The limit is $2,500 for each violation, unless the violation is intentional. Then the limit is $7,500 per violation. These penalties are used to support enforcement of the Act. This gives the attorney general an incentive for aggressive enforcement.
Effective January 1, 2020: You will be required to keep and to disclose to consumers the various categories and specific pieces of personal information that you collect. You must give consumers the right to opt-out of the sale of personal information. You may not discriminate against consumers who opt-out, or give discounts to those who permit their information to be sold.
On your internet home page, you must post a “conspicuous link” to a page that permits consumers to opt-out. (Instead, you may use an alternative homepage dedicated to California consumers.)
Effective Later: Certain definitions and obligations will be based on regulations to be adopted by the attorney general. Those regulations will be effective six months after the AG publishes them. The AG must adopt them by July 1, 2020, but may act sooner.
Conclusion: This is an accurate, but imprecise, summary of the Act. As mentioned, the Act adds 22 sections to the Civil Code and amends a 23rd section. Several of the individual sections are many times longer than this article. Implementation is likely to be a months-long project. If you would like our help, send an email to rhamlin@hamlinlaw.com.
Paid Advertisement
