A tidal wave is coming, but not from the Gulf of Mexico. A new California law will soon wash over businesses throughout the country, including many in Louisiana. The California Consumer Privacy Act (CCPA), the most consequential privacy legislation the U.S. has seen, goes into effect in less than 75 days. Why should you care? Because it could significantly impact many Louisiana businesses.
The CCPA applies to any for-profit business that handles “personal information” of California residents, B2C contacts, or has California-based employees, and that meets one of the following thresholds: (a) has annual gross revenues of more than $25 million; (b) receives or shares the personal information of at least 50,000 consumers, devices, or “households” (an undefined term); or (c) derives 50% or more of its annual revenue from consumer data sales. While the first trigger would exclude many small and mid-sized businesses, a Louisiana company could meet the second threshold if its website attracts only 140 California-based unique visitors per day.
Meanwhile, every emerging company may find that the CCPA applies if its business depends on web commerce. Also, companies that are third-party vendors to California-based businesses will be receiving requests from those customers that do business in California to show that their processing of personal information does not undermine the customers’ CCPA compliance.
For now, any Louisiana company whose business (including web commerce) touches California consumers should take time to determine whether the CCPA affects it—and how to comply as the January 1, 2020, effective date rapidly approaches. Compliance steps include updating (or creating) privacy policies, preparing a protocol for responding to data subject requests (including becoming familiar with exceptions based on statutory exclusions), and identifying service providers to assess their compliance. If you determine that California consumer data is being sold, shared, or transferred (under the statute’s broad statutory definition of that term), your business is in the crosshairs.
A final reason Louisiana companies should take notice is that the CCPA is likely a harbinger of things to come, as several states’ legislatures are considering similar consumer privacy measures. On the federal level, privacy legislation is a regular topic of discussion, and many think it will be modeled on California’s law. So even if your business manages to avoid this tidal wave from the West, the next one may deliver a soaking.
