California initiates privacy law to give consumers ownership of their personal data

The act will give consumers in the state unprecedented control over any personal information about them that a company might have collected. Thus, starting Jan. 1, 2020, CCPA confers upon California residents the right to ask a business for all data on them that the business might have collected.

Moreover, consumers will be granted the right to ask companies not to sell their personal data to third parties or to ask them to delete all of their personal data. The bill requires organizations to disclose exactly what categories of personal information it collects about a consumer - before the organization can actually begin to collect the data. Organizations will have to disclose their information collection sources, and the business purpose for collecting personal data and of any changes to those reasons.

Businesses will also have to disclose the categories of third parties with whom they share the information and obtain explicit opt-in consent for collecting data belonging to individuals that are younger than 16 years of age. Importantly, organizations that collect personal data on California residents cannot refuse service or provide lower service quality to individuals that dont want their personal data to be shared or sold to others.

CCPA allows any consumer whose personal data is exposed to sue the breached entity for damages ranging from USD 100 to USD 750 or more per exposed record.

According to Dark Reading, in intent and in requirements, the California statute is very similar to GDPR. The goal is to give consumers ownership of their personal data; more control over what organizations can do with the data; and the ability to hold businesses liable for failing to adequately protect the data.