Nobody is Ready for the CCPA, Not Even the State of California

The California Consumer Privacy Act will be a bumpy ride, according to Reece Hirsch, co-head of Morgan Lewis’ privacy and cybersecurity practice, quoted in The Verge. He notes that the law, which went into effect Jan. 1, is still being finalized. He is advising clients to update privacy policies, create processes for retaining copies of personal information about consumers, and determine who will handle requests for information and the deletion of information. According to California Attorney General Xavier Becerra, widespread enforcement of the CCPA isn’t likely until July. Nevertheless, companies shouldn’t view the upcoming six months as a grace period. He tells the San Francisco Chronicle that his office will help companies understand how it is interpreting the law, and once that’s done enforcement will be the priority. According to Hirsch, it’s not clear how California is defining the term “sale” of consumer information. He calls that a pain point for a lot of companies because it potentially includes sharing information about online advertising. Another issue he identifies: How is a company going to ensure it is deleting the right customer’s data without collecting more information to verify who they are?