Pub. 2 2020-2021 Issue 1

24 Anthony Bento, Director of Legal Affairs The CCPA Is Here: Stay Focused and Don’t Panic T he California Consumer Privacy Act (CCPA) went into effect Jan. 1, 2020. As many of you know, the CCPA is the nation’s first comprehensive pri- vacy law, as it creates substantial privacy rights for consumers and imposes corresponding obligations on businesses. These include: • Notice requirements. The CCPA requires businesses to make disclosures to consumers via privacy policies and other notices. • Specific information. The CCPA grants consumers an individualized right to know what personal information a business has collected, sold or disclosed about them. • Deletion. Consumers have the right to request busi- nesses to delete personal information, subject to certain exceptions. • Opt-out of the sale of personal information. Consumers over 16 years old have the right to opt-out of the sale for their personal information. Consumers younger than 16 must opt-in. • Data breach liability. The CCPA increases a busi- ness’s potential liability for data breaches, as it assigns statutory penalties for such breaches and empowers private individuals to file lawsuits to seek damages for such breaches. That’s a ton of information to digest, and it’s easy to un- derstand why some business owners may be tempted to throw their hands up in frustration and toss in the towel. However, there are several reasons not to despair. First, except for data breaches, the CCPA does not create a private right of action. In other words, private attorneys will not be empowered to directly sue for most violations of the CCPA. Second, the Attorney General (AG) will not begin enforc- ing the CCPA until July 2020. Taken together, these points should greatly reduce a dealership’s legal exposure for technical noncompliance with the CCPA. Indeed, the California Attorney General has publicly stated that his office will “look kindly on those that … demonstrate an effort to comply” with the CCPA. Despite the likelihood of limited initial enforcement on the CCPA, businesses that ignore the CCPA are painting a target on their backs. For example, it will be easy for