The California Consumer Privacy Act (CCPA) is a landmark piece of legislation that was enacted to enhance privacy rights and consumer protection for residents of California, United States. The CCPA was signed into law on June 28, 2018, and came into effect on January 1, 2020. This law was a significant step towards giving consumers more control over the personal information that businesses collect about them. Here are key details of the CCPA:

Purpose and Scope

• Consumer Rights: The CCPA aims to provide California residents with the right to know about the personal data collected about them, the right to delete personal data held by businesses, the right to opt-out of the sale of personal data, and the right to non-discrimination for exercising their CCPA rights.

• Applicability: The CCPA applies to any for-profit entity that does business in California and meets any of the following criteria: has annual gross revenues in excess of $25 million; buys, receives, sells, or shares the personal information of 50,000 or more consumers, households, or devices; or derives 50% or more of its annual revenues from selling consumers' personal information.

Key Provisions

• Transparency: Businesses must disclose the categories of personal information they collect, the purposes for which the personal information is used, and any third parties with whom the information is shared.

• Right to Access: Consumers have the right to request a copy of the specific personal information collected about them over the past 12 months.

• Right to Deletion: Consumers have the right to request the deletion of their personal data held by businesses and by extension, their service providers.

• Right to Opt-Out: Consumers have the right to opt-out of the sale of their personal information. For minors under the age of 16, affirmative consent is required to sell their personal information.

• Non-Discrimination: Businesses cannot discriminate against consumers who exercise their CCPA rights.

Enforcement and Penalties

• Enforcement: The California Attorney General is responsible for enforcing the CCPA. However, there is a provision for a private right of action for unauthorized access and exfiltration, theft, or disclosure of a consumer's nonencrypted and nonredacted personal information as a result of a business's violation of the duty to implement and maintain reasonable security procedures.

• Penalties: For violations of the CCPA, businesses can be fined up to $7,500 per intentional violation and $2,500 per unintentional violation if the violation is not cured within 30 days of notification. Consumers can also seek damages between $100 and $750 per consumer per incident, or actual damages, whichever is greater, in cases of data breaches.

Amendments and Future Developments

Since its inception, the CCPA has been subject to amendments to address ambiguities and operational challenges. Additionally, the California Privacy Rights Act (CPRA), also known as Proposition 24, was passed in November 2020, amending and expanding the CCPA, which introduces additional rights and protections for consumers and obligations for businesses. The CPRA's provisions are scheduled to come into effect on January 1, 2023, with some provisions having a look-back period.

The CCPA represents a significant shift towards more robust data privacy practices in the United States, similar in spirit to the European Union's General Data Protection Regulation (GDPR). It underscores California's role as a leader in the push for consumer privacy.