Impact of the California Consumer Privacy Act in 2020

// June 6, 2019
Reading Time: 3 minutes

Privacy has become a front-and-center issue for consumers and businesses over the past couple of years. Huge concerns have emerged about how companies protect or fail to protect consumer data. While criticism has brewed over Google’s and Facebook’s lax privacy protections for years, the situation came to a head with the Facebook/Cambridge Analytica scandal that erupted in March 2018.

According to the New York Times, Facebook allowed a third party (Cambridge Analytica) to gather extensive data on its users and use this information in a manner contrary to Facebook’s terms of service. In the outcry following the scandal, it became all too clear that existing laws were inadequate at protecting consumer privacy.

California responded quickly by passing the California Consumer Privacy Act (CCPA) in June 2018. Beginning January 1, 2020, the CCPA will provide consumers with the following rights:

  • The right to details of any personal information collected
  • The right to request deletion of personal information
  • The right to know the identity of any third parties to which personal information is sold or disclosed
  • The right to opt out of the sale of personal information by a business; the business would be prohibited from discriminating against the consumer for exercising this right

Businesses will be required to provide any of the above information to consumers at their request. The CCPA also authorizes businesses to offer financial incentives for the collection of personal information.

The impact of this law will be felt not just in California, but across the country. California’s economy and population are so large, very few firms in the U.S. will be beyond the reach of this law. In effect, the CCPA will become the de facto privacy regulation across the country.

The CCPA will fundamentally change how businesses handle consumer information. Almost every business has consumer data at some level, via rewards programs and customer management software or through other data collection tools. Businesses will have to know exactly what information they are collecting and how to respond to consumer requests to supply or delete data, and they must provide ways for consumers to opt out of data collection entirely.

The impact of the CCPA will be particularly acute for small and medium-size businesses. Large firms have the IT and legal resources to comply with the law, while small and medium-size enterprises will struggle to allocate the necessary resources to be fully compliant. Plus, time is quickly running out as the CCPA goes into effect at the start of next year.

While privacy issues have been a growing area of focus for businesses over the past decade, the passage of the CCPA (and the fines/penalties to be assessed for violations) represents a new day for privacy in the U.S. market. Specialty insurance carriers like us have built expertise in privacy liabilities and have the forms and risk management to match. Quality underwriters can help your clients navigate these changes in privacy law by pointing insureds toward proper risk management.

Contact your Devon Park Specialty underwriter today to learn how our Errors and Omissions, Media and Privacy (EMP) product can protect your clients.


As always, thank you for your support and business.

Jeff EstabrookContact and Written By Erik Tifft
Product Leader | 844-438-6775, ext. 2354
June 6, 2019