California Passes Its Own GDPR Law

The European Union’s General Data Protection Regulation (GDPR) is widely viewed as a massively expensive and burdensome privacy regulation that can be a major headache and pitfall for American firms doing business in Europe. Many firms, including Facebook, have sought ways around the law to avoid having to deal with the burden of compliance.

Well, there is no weaseling out now. Recently, with no fanfare, California Governor Jerry Brown signed into law AB375, the California Consumer Privacy Act of 2018, the California equivalent of GDPR that mirrors the EU law in many ways.

The law will give the State's 40 million residents the right to view the data that companies hold on them, make corrections to it, and request that it be deleted and not sold to third parties.

Facebook tried to get around the European regulations by shifting its entire European user base to US protections, but it didn’t work. The day GDPR went into effect, Facebook and Google were sued for a total of $8.8 billion by one privacy advocate in Austria.

Any company that holds data on more than 50,000 people is subject to California's law, and each violation carries a fine of $7,500. That may not seem like much, but it can add up when tens of thousands of users are involved, as they usually are.
Opposition to California Consumer Privacy Act of 2018

The Internet Association, a trade association of all the major Internet companies, issued a statement critical of the rushed process to pass the bill.

“Data regulation policy is complex and impacts every sector of the economy, including the internet industry. That makes the lack of public discussion and process surrounding this far-reaching bill even more concerning,” said IA's vice president of state government affairs, Robert Callahan, in a statement.

“The circumstances of this bill are specific to California. It is critical going forward that policymakers work to correct the inevitable, negative policy and compliance ramifications this last-minute deal will create for California’s consumers and businesses alike,” he added.

He’s not kidding on the expediency of the bill’s passage. The bill was first introduced in February 2017 but set to inactive in September. It was revived on June 21 and sped through the process, with unanimous votes in the state Assembly and Senate. Brown signed it literally hours after its passage. Why was it rushed? The Register reported that two very politically savvy individuals were working on a ballot initiative to do the same thing. What scared Sacramento is that ballot initiatives, once passed, are hard to change. That’s why Proposition 13 has survived so many years.

The tech sector and Sacramento bureaucrats were faced with a choice: pass their legislation that they could change later and hopefully persuade the duo to pull their ballot initiative, or they could roll the dice on a ballot initiative that, if it passed, would be much harder to change in future.

With the legislature and Governor Brown giving the two advocates what they wanted, the pair didn’t file for a fall ballot spot, even though they had enough signatures.

How the California Consumer Privacy Act of 2018 affects Companies' Data Center Operations
What happens now? If you do business in California, you have to comply with the law, and so does any company that you sell customer data. If they violate the law, you are on the hook for it. And you have to add a “Do Not Sell My Personal Information” link to your site. No doubt the law will be challenged, and the ballot can always come back if the law is weakened or overturned.

If you are potentially impacted by GDPR in any way, you should have already done some compliance. Now, if you do business in California you will have to, even if you aren’t in the State.

Basically, all the best practices for GDPR apply here. This means making sure all of your data is accurate. Now would be a really good time to revisit customer and mailing lists because if there are inaccuracies you can find it will save the trouble of doing it later. Old, outdated or obsolete data can be removed.

Make sure all data collection channels know of the new rules and adjust accordingly to take in correct data and quickly get at it to make changes or removals. Make sure to document data handling rules so everyone who handles data, either for intake, editing or management, knows what is expected.

Companies impacted by GDPR are being encouraged to hire data protection officers or something similar. Given the sensitivity of data breaches, that might be a good practice even without the law.

Take a complete inventory of your customer data and make sure you know where everything is. If a consumer requests their information, you must provide it free of charge within 45 days. That is not the time to go rummaging through databases for their information. And if you are informed of noncompliance with the law, you have 30 days to respond. 

So, expediency is paramount. That means knowing where everything is. The only good bit of news is it doesn’t go into effect until January 1, 2020. Of course, anything can happen between now and then. But at least companies have time to get into compliance.

Network World

You Might Also Read: 

Is GDPR Good For SME Data?

GDPR - More People Will Share Data:

 

« Five Tips To Secure IoT
ICO Fine Facebook Half A Million Pounds »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

NCC Group

NCC Group

NCC Group is a global cyber and software resilience business operating across multiple sectors, geographies and technologies.

Absolute Software

Absolute Software

Absolute provides persistent endpoint security and data risk management solutions for mobile devices - computers, tablets, and smartphones.

Foregenix

Foregenix

Foregenix are global specialists in Digital Forensics and information security including Penetration testing and Website Security.

CSA Events

CSA Events

Cloud Security Alliance conducts a series of conferences around the world. This listing provides a link to details of upcoming events.

Jetico

Jetico

Jetico provides pure & simple data protection software for all sensitive information throughout the lifecycle. Solutions include data encryption and secure data erasure.

Protection Group International (PGI)

Protection Group International (PGI)

PGI helps organisations and governments to manage digital risk. From cyber security services to business intelligence, we help reduce the risks to your finances, reputation, assets and people.

White & Black

White & Black

White & Black are specialist corporate & technology lawyers based in London & Oxford.

Crosspring

Crosspring

Crosspring is an incubator/accelerator for people who have the ambition to start a successful business or want to extend their existing business in the areas of FinTech, AR, VR, Cybersecurity and SaaS

Evalian

Evalian

Evalian is a data protection services provider. Working with organisations of all sizes, we specialise in Data Protection, GDPR, ISO Certification & Information Security.

Conference on Applied Machine Learning in Information Security (CAMLIS)

Conference on Applied Machine Learning in Information Security (CAMLIS)

CAMLIS is a venue for discussing applied research on machine learning, deep learning and data science in information security.

Viria

Viria

Viria is an information and security technology solution provider that promotes digitalization in a secure way.

doIT Solutions

doIT Solutions

doIT solutions specialize in IT security and infrastructure, security automation, data center, and cybersecurity.

Advent One

Advent One

Advent One are recognised for solving intricate dilemmas, not only making technology work but building foundations that customers can grow upon in an effective and secure way.

McAfee

McAfee

McAfee is a worldwide leader in online protection. We’re focused on protecting people, not devices. Our solutions adapt to our customers’ needs and empower them to confidently experience life online.

HighGround

HighGround

HighGround offer a Cyber Security Solution for everybody, regardless of skillset, to feel empowered in their security experience in reaching Cyber Resilience.

TIM Enterprise

TIM Enterprise

TIM Enterprise offers innovative, sustainable and secure 360-degree digital solutions to companies and public administrations.