companies that have worked on compliance
with the general data protection
regulation of the European Union are
definitely better prepared to comply
with the California consumer Privacy Act
and companies who have not I feel sorry
for those of my clients who have a
domestic focus and who were spared by
the GDP are only to now find that they
have this much more rigid prescriptive
and intrusive law to comply with which
may come particularly if we get a right
of private action which much more harsh
enforcement and companies who have
already worked on GDP are typically have
a better sense of what systems they're
using what vendors they have they can
send out communications to vendors more
quickly they can find what data they
have better to update the data privacy
notices they have probably some
experience with data subject access
deletion and portability requests which
are also going to be coming forward
under the California consumer Privacy
Act and therefore they are generally in
better shape they typically have a
governance program accountability they
have people in their company who are in
charge of privacy and this will make
things easier but the CCPA the
California consumer Privacy Act is not
anywhere close to being a mini gdpr as
some have called it it has nearly as
many words the GPR weighs in with 30,000
words but it has a lot of stuff that is
not in the California consumer privacy
acts such as Data Protection Authority
organization coordination within Europe
filing requirements consultations
produce accountability documentation
under five to 24 and 32 under the GD P R
we have various paperwork and
formalistic requirements that the GPR
imposes on companies which California
companies also have to grapple with but
under many other laws the California
consumer Privacy Act is not an omnibus
it's one of literally hundreds of laws
that we already have in California on a
federal level that companies have to
comply with on top of all these other
laws so companies that sometimes come to
me that say well we're already doing
gdpr so we don't have to do that much is
not probably an accurate assessment of
the situation
the California consumer Privacy Act is
in the tradition of California and us
privacy laws that focus on a particular
problem harm situation sector it is
broader than many privacy laws that
we've seen before but it is trying to
address perceived harms and threats
associated with sharing of personal data
by anybody in the industry it is broader
it's not a sectoral law but it is
focused on data sharing with 10,000
words and these super constrictive
requirements whereas the gdpr
tries to govern everything else relating
to data and is really a data processing
regulation rather than a privacy law
because it is not that focused on
individual privacy harms it just
generally tries to limit the amount of
data that is being processed how long it
is processed for what purposes companies
have to justify to process personal data
all that is not the case under the
California law the California law just
put some rigid restrictions and
individual rights into effect that will
limit the amount of data that companies
can share and use and collect and that
is a different focus and so I would say
to all the companies that have done a
good job on GDP our compliance you're in
good shape you're in better shape you're
ahead but they still work to be done
you