It’s War! CCPA v. GDPR

Blogging on Security Boulevard, Rakesh Soni likens the competing data privacy regimes of the EU and the State of California to a war, but like our headline, that’s just an attention-getting device. He does compare and contrast the two usefully, and notes that those regulatory protocols taken together foreshadow a trend: More governing bodies will implement privacy and consent regulations with heftier repercussions for noncompliance. There are some notable differences between the CCPA and the GDPR, among them: Although both affect any business that collects data from the residents they protect regardless of where the business is based, the GDPR does not look at the size of the business when implementing its regulations. The CCPA, however, requires businesses to be a certain size or possess a certain amount of data before the law will be enforced. In respect to punishment, fines accrued via the GDPR are linked to and capped based on a company’s annual revenue, whereas CCPA fines have no ceiling and are assessed on a per violation basis. Prior to collecting data, the GDPR requires that businesses ask consumers to opt-in. The CCPA requires that businesses allow users to opt-out of collection.