Schedule a Consultation: 858.483.9200
CCPA Effective Date Looming: Is Your Toll-Free Number Up and Running?
The California Consumer Privacy Act (“CCPA”) effective date is January 1, 2020. That is a bit more than four months from now. Among the many provisions of the CCPA is a requirement that businesses subject to the Act have a toll-free number available for consumers. Under the CCPA, consumers have the right to contact a business collecting data for these purposes:
- Asking about what data is collected
- Asking about the source of the data collected — direct, third party, or other
- The reasons for collecting the data — the commercial purposes such as “processing your transaction” or “quality control,” etc.
- Asking about who receives the data that is collected — third-party sharing, transfer, exchange, or selling
- Obtaining copies of the data collected about them
- Requesting that data be deleted
If the CCPA applies to your business, the Act requires that you give the consumers two methods of contacting your business — an email address and a toll-free phone number that consumers can call. See CCPA § 1798.130.
Does My San Diego Business Need a Toll-Free Number?
Your San Diego business needs a toll-free number if the CCPA applies to your business. More businesses will be subject to the CCPA than you might think. Even a small business — say only $5 million in revenue — could be subject to the Act. The CCPA is applicable to any “entity” that “does business” in California and that either directly or indirectly collects personal data, decides what is done with the data or how it is collected/processed, and meets one of these criteria:
- Has annual gross revenue in excess of $25 million; or
- Annually buys, sells, shares, or receives personal data with respect to 50,000 or more consumers, households, or devices; or
- Derives 50% or more of its annual revenues from selling consumer personal data.
See CCPA § 1798.140(c). This last category is where small businesses might get caught up in the requirements of the CCPA. Note that the definition of “selling” consumer data is very broad. The Act defines “selling” as “… selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating … a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.” The final few words — “other valuable consideration” — means that your business is “selling” personal data if you are receiving data in exchange or if you receive any sort of value in return for the data.
Every San Diego business must evaluate the unique circumstances of your business. A data collection audit must be done. If you engage in any online transactions, your business is collecting personal data. Even if you only engage in point-of-sale transactions, your business might still be collecting personal data via credit card transactions. Marketing is another place where data is collected. Are you asking for email addresses or suggesting that consumers download your company’s app?
What Else Should I Know About the Toll-Free Number Required by the CCPA?
There are a few other issues with requests that might start coming into your business. Here are three important issues: First, train your employees on how to respond to consumer questions. You want your employees to provide the correct information and the correct procedure if a consumer asks about what data is collected. The consumers should be referred to the website or to the toll-free number. Second, the information does not have to be provided instantly. Answers to a consumer inquiry must be made within 45 days. Third, a business is required to provide the information only to the consumer who is asking and only after/if the consumer can verify his/her identity. The CCPA has additional provisions related to consumer inquiries and, as such, complying with the CCPA will be complex. Now is the time to start. It is a good idea to seek the advice and counsel of an experienced San Diego corporate attorney.
Contact San Diego Corporate Law Today
For more information, contact attorney Michael Leonard, Esq., of San Diego Corporate Law. Mr. Leonard can be reached at (858) 483-9200 or via email. Mr. Leonard has been named a “Rising Star” for four years running by SuperLawyers.com. Mr. Leonard provides a full panoply of legal services for businesses and proudly serves the San Diego business community. Like us on Facebook.
You Might Also Like:
What the California Consumer Privacy Act of 2018 Means for San Diego Businesses
Update: 2018 California Consumer Privacy Act is Amended
Mergers & Acquisitions: How Does The CCPA Impact The Deal?
