California Consumer Privacy Act (CCPA) Compliance

What Is CPRA?

In 2020, California voters passed Proposition 24, which brought in the California Privacy Rights Act (CPRA). The CPRA made key updates to the CCPA, strengthening privacy protections even further. These updates took effect on January 1, 2023, adding more rights for consumers, such as:

• Right to Correct Inaccurate Information: Consumers now have the right to request the correction of any inaccurate personal information that a business holds about them. This gives individuals more control over ensuring that the information companies have is up to date and accurate.
• Right to Limit the Use of Sensitive Personal Information: The CPRA adds a new layer of protection for sensitive personal data, such as health information, financial details, and precise geolocation. Consumers can now request that businesses limit how this sensitive information is used and shared, ensuring that it’s only used in ways necessary to provide requested goods or services.
• Expanded Right to Know: Under the CPRA, consumers not only have the right to know what personal information is being collected, but they now have the right to understand how long a business intends to retain that data. If a specific retention period isn’t available, businesses must disclose the criteria they use to determine how long they keep personal information. 
• Cybersecurity Audits: The CPRA requires businesses to conduct regular risk assessments and cybersecurity audits for activities that pose significant risks to consumer privacy to ensure companies are actively evaluating and improving their data protection measures.

It’s important to note that the CPRA is an amendment to the CCPA, not a completely separate law. That’s why we often refer to it as “CCPA, as amended” to reflect these updates.

How Does CCPA Compliance Work?

The CPRA applies to businesses that meet specific thresholds, including: 

• Companies with annual revenues over $25 million.
• Those that collect or share data from 100,000 or more California residents.
• Companies that make 50% or more of their revenue from selling personal data. 

If a business falls under these criteria, it must comply with the CCPA and CPRA by implementing several key practices to protect consumer privacy:

• Responding to customer requests for what personal data the company has collected, requesting the business to delete or correct their personal data, and asking businesses to opt-out of the sale or sharing of their data.
• Sending customers a “notice at collection,” which must list the categories of personal information businesses collect about consumers and the purposes for which they use the categories of information.
• Implementing data security measures to avoid data breaches and misuse, businesses must take reasonable steps to secure the personal data they collect.

Importantly, businesses cannot discriminate against you for exercising these rights under the CCPA, and businesses cannot make you waive these rights. CCPA violations would include a business denying goods or services, charging you a different price, or providing a different level or quality of goods or services. 

Consumers should ask themselves the following questions:

• Is a company’s data monitoring lawful, fair, and transparent?
• Is the company taking every reasonable step to erase or correct data that is inaccurate or incomplete?
• Does the company delete personal data once it no longer needs it?
• Is the data collected appropriately secured?

How Do I Know If I Can File a CCPA Lawsuit?

You can sue businesses under the CCPA if your first name (or first initial) and last name, in combination with any of the following, are compromised:

• Social security number
• Driver’s license number
• Tax identification number
• Passport number
• Military identification number
• Other unique identification numbers issued on a government document
• Financial account number
• Credit card number
• Debit card number with security code
• Medical or health insurance information
• Biometrics: Fingerprint, retina or iris image, or other unique biometric data

Data privacy is a very complicated area of law, and it’s easy to get tangled up in the web of technical and legal jargon. However, a lawyer can take the time to walk you through and break down everything so you’re not going in blind. 

Plus, studies have shown that enlisting the help of a lawyer can greatly benefit your case, with over 90% of those with legal representation securing a settlement or award, compared to just 50% of those who went it alone.

Who Enforces CCPA And CPRA?

One of the most significant changes brought by the CPRA is the establishment of the California Privacy Protection Agency (CPPA). This agency is now responsible for enforcing both these data privacy laws, providing clearer oversight, and ensuring that businesses follow CPRA compliance. 

Why Hire The Lyon Firm to Defend Your Data Privacy

Identity theft, fraud, and financial loss are just the start of what can happen when your personal information is compromised. You don’t have to accept things the way they are.

Our firm strongly believes that consumers should never be made to feel insignificant or pressured into disregarding their rights just because businesses believe they can get away with it. It is these ideals that have driven us to stand up against those who violate data privacy laws, recovering millions for clients, including: 

• $12,500,000: Co-lead class counsel in a data breach case against Health Aide of Ohio, involving 141,149 medical patients, securing a nationwide settlement that provided monetary compensation and identity theft protection for the affected class.
• $9,250,000: Co-lead class counsel in a TCPA (Telephone Consumer Protection Act) class action against Navy Federal Credit Union, securing final approval for a nationwide settlement providing monetary compensation to a class of over 66,000 people. The TCPA restricts unsolicited marketing calls, prerecorded messages, and robocalls, ensuring consumers’ privacy is protected from intrusive communications.

For 19 years, The Lyon Firm has made it our goal to ensure that the data privacy and rights of people are not trampled on by large corporations simply because they have resources and wealth. Your privacy matters, and your rights deserve to be respected, no matter how big the company you’re up against. Contact us today online or by calling (513) 381-2333.