How Does The CCPA Compare To The GDPR?

On May 25, 2018, the General Data Protection Regulation (GDPR) came into effect - marking one of the most critical digital developments of the century. The legislation originated in the European Union (EU), and effectively protects the data rights of European Economic Area (EEA) residents. However, companies around the world that target users in the EEA are subject to comply with the hefty legislation.

While the effects of the GDPR itself have been felt these past two years, one of the most notable changes it has brought to the digital space is an influx in copycat legislation, and a call for similar protections to users’ data around the globe. 

Among the laws, regulations, and guidelines that have followed in the footsteps of the GDPR is the California Consumer Privacy Act (CCPA). As its name implies, this law comes from California, and serves to protect Golden State residents whose data is collected and shared by companies all over the world. 

How Are the CCPA and GDPR Similar? 

The CCPA is based on the GDPR, although it is notably lighter in size and scope. Both laws seek to protect the rights of individuals over their personal information by establishing data-handling best practices for businesses, and new data rights for users.

Among the shared features of the laws is the emphasis on accountability.  Both pieces of legislation threaten hefty fines for companies who fail to protect the data they collect from individuals and establish minimum expectations of data security. 

For example, both the GDPR and the CCPA emphasize the need for companies to implement Privacy by Design (PbD). PbD is the idea that privacy measures and data protection is built into the very framework of a business, website, or app. 

Given the potential consequences for failing to take data privacy seriously - millions of dollars in fines - both laws are setting new standards for data safety. 

How Are the Laws Different? 

While the CCPA is sometimes referred to as the California GDPR, these laws are far from the same. The GDPR is notably stricter, broader in scope, and ladened with far fewer loopholes than the CCPA. 

For example, the CCPA sets thresholds to determine what companies are subject to comply. These thresholds include annual revenue, revenue generated by data sale, and how many consumers’ data is collected. 

The GDPR, on the other hand, is applicable to any business that targets users in the EEA — regardless of company size, location, or revenue. In effect, a small travel blog in Idaho that sends newsletters to a few people in Switzerland is subject to comply with the GDPR. They would not, on the other hand, likely need to comply with the CCPA. 

Another key distinction between the two laws is the extent of their guidelines. The GDPR lays out extensive guidelines and boundaries for proper data handling, while the CCPA sets remarkably fewer strictures. 

Of the most significant requirements the GDPR establishes is the right for users to opt in to data collection. This guideline revolves around the notion that if businesses aren’t collecting data on a legal basis such as legitimate interests or to fulfill a contract, they should be basing that data collection on user consent. Therefore, businesses need to ask for users to opt in to the collection of their data. 

Alternatively, the CCPA has no such guidelines, and only sets a requirement for businesses to allow users to opt out of the sale of their personal information. 

What Does It All Mean for Businesses? 

Not only are thousands of businesses around the world subject to comply with one or both of these landmark privacy laws, but the GDPR and CCPA are only the beginning of a new wave of digital legislation. 

With over a hundred countries implementing or working to implement similar laws, the CCPA and GDPR are the foundation of the new standards for data privacy and protection. 

If you own or operate a website, app, or business that relies on consumer data, you need to understand these laws and the goals they seek to achieve.

To learn more about the key similarities and differences between the GDPR and CCPA, check out this infographic from Termly below:

You Might Also Read: 

GDPR's Impact In The US And Globally:

 

 

« Take Action On Cyber Security Training
AI Can Give An Early Warning Of Coronavirus »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Lima Networks

Lima Networks

LIMA design and deliver IT Infrastructure solutions and services including managed Security Monitoring services.

Senetas

Senetas

Senetas is a leading developer and manufacturer of certified high-assurance encryption solutions, dedicated to protecting network transmitted data without compromising performance.

Truth Technologies Inc (TTI)

Truth Technologies Inc (TTI)

TTI is a premier provider of worldwide anti-money laundering, anti-fraud, customer identification, and compliance products and services.

CloudLayar

CloudLayar

CloudLayar is a cloud-based website firewall for protecting your website against online threats.

AVR International

AVR International

AVR educate, advise, analyse and provide professional, technical consultancy and support to ensure your business is safe, compliant and protected.

KZ-CERT

KZ-CERT

KZ-CERT is the national Computer Emergency Response Team for Kazakhstan.

SAI360

SAI360

SAI360 (formerly SAI Global) provide products and services for enterprise risk management including Governance, Risk & Compliance and Digital Risk solutions.

AuthenTrend

AuthenTrend

AuthenTrend provide biometric authentication products to achieve high security with extreme ease-of-use for the user.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Base Cyber Security

Base Cyber Security

Base Cyber Security is an information and cyber security talent service provider and career specialist.

Third Point Ventures

Third Point Ventures

Third Point brings deep technical expertise, a strong network of relationships, and decades of investing experience to add value to our partners throughout their journey from idea to IPO and beyond.

GTT Communications

GTT Communications

GTT are a global network provider that serves thousands of multinational and national enterprise, government and carrier customers with a portfolio of advanced connectivity and security services.

Cyber Law Consulting

Cyber Law Consulting

Cyber Law Consulting is a Dynamic full service legal firm which offers complete services for Cyber Law, cyberlaw, Internet Law, Data Protection Act, Cyber Security, IPR, Drafting.

HighGround

HighGround

HighGround offer a Cyber Security Solution for everybody, regardless of skillset, to feel empowered in their security experience in reaching Cyber Resilience.

Space Hellas

Space Hellas

Space Hellas is a dynamic, established System Integrator and Value Added Solutions Provider, holding a leading position in the high technology arena.

NeuroID

NeuroID

NeuroID combines the power of industry-leading behavioral analytics with advanced device and network intelligence to create your first line of defense against malicious bots, bad actors, and fraud.