California Is the First to Bring European-Grade Data Protections to the United States

Executive Summary: California has become the first state to introduce privacy protection for individuals’ personal data comparable to that provided under the European Union’s General Data Protection Regulation (GDPR). The California Consumer Privacy Act of 2018 (“CCPA” or “the Act”), which takes effect January 1, 2020, is a sweeping digital privacy law that creates new protections and rights for consumers’ personal data. The CCPA will grant California consumers the following rights: (1) to know what personal information is being collected about them; (2) to know whether their personal information is sold or disclosed and to whom; (3) to say no to the sale of personal information; (4) to access their personal information; and (5) to equal service and price, even if they exercise their privacy rights (e.g., businesses may presumably offer tiered pricing for goods and services, such as offering higher prices for increased privacy); and in addition, to hold companies liable for data breaches.