with respect to the California consumer
Privacy Act of 2018 the most important
thing that companies should focus on
right now is the decision whether they
will engage in selling of person
information as this is defined in the
law the definition is very
counterintuitive to many companies the
first reaction is we don't sell personal
information but if they closer review of
the situation usually results in a
finding that there are a lot of data
sharing arrangements that meet the
definition in companies in most spaces
can actually opt to stop selling
personal information the way this is
defined if that's what they choose to do
and they should have that discussion now
and think about where the California
consumer Privacy Act will take them if
they either continue on the current path
or they make changes so that they're not
engaged in selling
if they continue to do what they're
doing now they will have to put a
prominent link on every web and mobile
page where California residents can
access data and by necessity leave some
personal information snippets IP
addresses and other things that are just
required to respond to a query and this
link will have to say the words do not
sell my person information and it has to
be conspicuous invisible and it will be
utterly confusing and very irritating to
people in other states and other
countries where they're not familiar
with the history of this law and where
they thinking selling means you give my
named user information that what they
think about personal information for
cash payments or other transactions like
this what the statute covers as well but
the statute covers much more it even
covers exchanges with service providers
if they're not restricted to to the
letter of this law so if the company
puts that link up there and they get up
touts after January 1 2020 then they
will have to cut off the sharing with
any company where they didn't qualify
the relationship is not involving
selling and they will not be allowed to
discriminate against the user who opted
out so they will have to continue to
provide the service most companies have
extended enterprises with a whole suite
of software service providers and if
they start getting opt-outs that they
cannot use certain systems anymore they
would have to rebuild on-premise systems
or other things that would be quite
difficult to create so companies should
think about that they should think about
that if somebody has opted out they
cannot prompt them for an opt-in with
the next 12 month most companies with
different landing pages cannot really
control whether there are prompts to opt
in certain things with a different set
of privacy terms that easily because
they would have to identify people and
see that somebody's already opted out
and there would be a lot of
different systems to have to be built if
the company says we will continue to do
whatever we're doing now and doesn't
eliminate the selling on the other hand
if the company does eliminate the
selling it will be quite painful in some
areas where right now the whole
ecosystem involves sharing of
information for the benefit of their
customers and that are not ready to
support their customers without sharing
arrangements that could still qualify a
selling of person information so I'm not
saying that is necessarily the easier
way but it does avoid that ugly link on
every page and mobile page and website
that would be definitely have a negative
brand on brand impact on companies so
that's the big decision that companies
should do right now if they haven't
already done