Pub. 1 2019-2020 Issue 2

10 California Consumer Privacy Act: What Dealers Need to Know Alisa Reinhardt, Director of Regulatory Affairs, CNCDA and Anthony Bento, Director of Legal Affairs, CNCDA T he California Consumer Privacy Act of 2018 (CCPA) was one of the most sig- nificant laws the state legislature passed last year, granting consumers a host of new rights with respect to personal information that businesses have collected about them. While the CCPA technically goes into effect January 1, 2020, many of the requirements and penalties on businesses cannot be enforced until July 2020. Despite the CCPA’s impending effective date, the law is very likely to undergo further modifications this legislative ses- sion, making industry preparation efforts even more complicated. The California Attorney General’s Office is also planning to begin their rulemak- ing on the CCPA in the fall of 2019. We have only seen the beginning of negotiations and advocacy efforts on future amendments and regulations on the CCPA. CNCDA has joined a coalition of business groups to jointly advocate for common-sense amendments to the CCPA. CNCDA is also sponsoring legislation that will ensure that the retail automotive industry will be able to retain cus- tomer data related to recall efforts. However, consumer privacy advo- cates impugn the motivations behind business industry proposals, and they are largely unwilling to negotiate on anything but the smallest fixes to the CCPA. This makes it unlikely that the California legislature will provide significant relief to the business com- munity. As such, it is incumbent on dealers to begin developing a CCPA compliance strategy today. Current CCPA Requirements Right to Request Disclosure of Information The CCPA grants consumers the right to request a business to dis- close the following: • The categories of personal infor- mation it has collected about that consumer; • The categories of sources from which the personal information is collected; • The business purpose for collecting or selling personal information; • The categories of third parties with whom the personal information is shared; and • The specific pieces of personal information it has collected about that consumer. Responsibility to Inform Consumers The CCPA requires businesses that collect personal information about consumers to inform them of the cat- egories of personal information to be collected and the purposes for which the categories of personal informa- tion shall be used. This notice must be given to consumers at or before the point of collection. In addition to this notice requirement, businesses must make available to consumers two or more designated methods for submitting requests for information, including, at a minimum, a toll-free telephone number and a website address. Information about the CCPA also needs to be included in a business’s online privacy policy, and an opt- out button must be made available on the business’s internet homep- age that is entitled “Do Not Sell My Personal Information.” Right to Request Deletion of Information Consumers can request a business de- lete any personal information collected about them and can opt out of the sale of their personal information. Once a