SACRAMENTO – As the California Consumer Privacy Act (CCPA) nears its Jan. 1 enactment, businesses across the state are preparing for the relatively unknown as they push for full compliance with the new internet privacy bill. Small businesses in particular are expected to struggle to keep up with the costs and complexity of the law, leaving many with uncertain futures.
“The Jan. 1, 2020, deadline for compliance with the California Consumer Privacy Act (CCPA) is fast approaching, but many businesses are still struggling with this complex law and additional changes on the horizon,” said Kyla Christoffersen-Powell, president and CEO of the Civil Justice Association of California. “Without meaningful clarification, we can expect a whole new variety of shakedown lawsuits even as businesses expend time and money to comply.”
The CCPA is intended to enhance privacy rights and consumer protection for the state’s residents, however, its vague yet comprehensive nature has left many with more questions than answers as legislators have pushed late for reform and clarity.
Closing in on the bill’s final makeup, Gov. Gavin Newsom in October signed another round of amendments (Assembly Bills 25, 874, 1146, 1355 and 1564) as well as an amendment to the state’s data breach law (Assembly Bill 1130).
Now, those who will be affected by the CCPA are focused on recent draft regulations proposed by California Attorney General Xavier Becerra. The attorney general’s office held public hearings in four cities across the state last week and accepted written submissions until last Friday as the office will now review and revise a final bill.
State business leaders are hoping the final makeup of the bill will bring more clarity to the state’s expectations; once the bill is in effect, the attorney general is prevented from bringing an enforcement action for noncompliance before July 1, 2020, or six months after publication of the final regulations, whichever is earlier.
Business leaders have been vocal not only about potential exposure to "shakedown" lawsuits, as with the ability of understaffed businesses to comply.
“Consumer privacy is the foundation of any manufacturers’ success,” said the California Manufacturers & Technology Association in a statement. “California’s new Consumer Privacy Act will impose significant new costs associated with the legal, operational and business aspects of compliance, but the largest concern right now is getting compliant by the 2020 deadline. Manufacturers will have to analyze the requirements, identify the impacts on processes, assign staff to work through the many changes, create project plans, and implement monitoring to ensure compliance. California is at the forefront of consumer privacy but the CCPA and its deadlines will make it very difficult to get compliant before penalties and private rights of actions are brought.”
There is also the worry that some businesses may have no idea that the law was ever even introduced to begin with – posing even more issues for the state’s economy and already challenging legal climate.
“The tragic reality is that most California small businesses aren't preparing to comply with CCPA because they simply have no clue it is on the books, let alone set to be enforced in early 2020,” said John Kabateck, president of Kabateck Strategies and state director of the NFIB Small Business Association. “Recent studies have revealed that while 75 percent of all businesses in the state will be impacted by the CCPA, a mere 8 percent of businesses are sufficiently prepared, 22 percent have no knowledge, and 58 percent are beginning to educate themselves about this onerous, complicated law.”
Kabateck, like many other experts throughout the state, also believes that the bill was hastily pushed through with little to no input from citizens.
“Our state policymakers failed the citizens they serve first, by passing this law with little to no prior input from the very individuals it will impact the most – small businesses – and second, by refusing to make responsible, necessary modifications that would help mom-and-pop small businesses reasonably comply in a sufficient manner and time frame,” said Kabateck. “Now, in these final days before the new year, employers are expected to interpret 33 pages and more than 10,000 words of complex data law or face the threat of shakedown lawsuits. It's horribly sad that our state leaders’ inaction with CCPA will most certainly lead to scores of Main Street doors closing and countless Californians losing their jobs.”