What is the CCPA?
The California Consumer Privacy Act of 2018 (or “CCPA”) is a new state privacy law in California that took effect on January 1, 2020. The CCPA applies to the collection, disclosure, and sale of California residents’ personal information. It imposes new privacy compliance obligations on businesses that process personal information of California residents and it creates new privacy rights for California residents.
Who has to comply with the CCPA?
Entities qualify as a “business” that must comply with the CCPA if they are for-profit, do business in California, collect or direct the purposes and means for the collection of California residents’ personal information, and satisfy certain revenue or consumer thresholds defined by the statute.
What are consumers’ rights under the CCPA?
The CCPA gives California residents the right to:
Know what personal information has been collected by a business, how it is used, how it is disclosed and to whom, and to know their rights with regard to that data;
Opt out of the sale of personal information;
For minors under 16 years of age, opt in to the sale of personal information;
Access and delete personal information;
Equal service and price, even if they exercise their privacy rights; and
Sue for damages and other relief after a breach of unencrypted/unredacted data.
What counts as a “sale” under the CCPA?
The CCPA’s defines a “sale” of personal information very broadly and includes more than simply sharing personal information in exchange for money. Rather, it includes any “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.”
How do I make sure my disclosures of customer information aren’t a “sale” under the CCPA?
Sharing personal information with service providers like ServiceTitan aren’t considered a “sale” under the CCPA if certain contractual requirements are met. To help you meet this obligation, we have a California Data Processing Addendum available for customers who share personal information with us that is subject to the CCPA. Our California Data Processing Addendum makes clear that ServiceTitan is acting as your “service provider” under the CCPA and establishes our respective obligations for CCPA compliance purposes. To request a CCPA DPA please reach out to your customer success manager or firstname.lastname@example.org. We recommend consulting with your legal counsel to best determine whether and how to comply with any other obligations you may have under the CCPA.