The California Consumer Privacy Act (CCPA) grants consumers rights related to the collection, use and sale of their personal data—and prevents businesses from discriminating against them for exercising those rights. It applies to organizations that do business in California if they meet specific requirements. When the CCPA takes effect on January 1, 2020, businesses must implement and maintain reasonable data security policies and procedures that are appropriate to the nature of the personal information they collect.
Under the CCPA, consumers have the right to:
Can your organization answer all of these questions, quickly, accurately, and efficiently?
Informatica data governance and privacy solutions provide a framework designed to help you meet this challenge: to discover what sensitive data you have, where it is located, who can access it, how it’s being used, and how you can best protect it to lower risk while keeping data open for business.
The CCPA has three main differences:
Many organizations are starting by conducting risk assessments, including data discovery and identity mapping to find out where personal data resides, who it belongs to, and where data is proliferating. They are updating privacy policies and procedures and implementing automation technologies so they can quickly address customers’ requests to access, view, or delete personal information. They are checking service agreements with partners and other third parties to control data lineage, and applying remediation such as data masking to govern data privacy.
The CCPA contains a broader definition of personal data than the GDPR. It covers any information that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Your privacy framework must be able to protect information ranging from traditional personally identifiable information to web browsing histories, geolocation data, audio recordings, and more. You must also protect any "inferences" used to create a customer profile.
Under the CCPA customers must be able to opt out of any selling of their personal data. It also requires prior consent for selling of minors’ data. Properly acting on opt-out rights and consents can build trust assurance within your customer base—and customers are more willing to share data with companies they trust. In this way, consent management becomes a customer experience opportunity, not just a compliance cost.
The effort you put into complying with the GDPR and the CCPA can serve as initial steps toward implementing a global-ready data privacy governance framework for an enterprise-wide data protection strategy. Use the the current regulations' accountability requirements to improve your ability to quickly and accurately find data across your enterprise, automate data protection controls, and to be transparent about mitigating privacy breaches and accelerating risk resolution.
Operationalizing data privacy by adding AI and machine learning can help you prepare and act on information more quickly. AI can assist in identity resolution to verify identities before responding to consent, data access, or data deletion requests. AI-powered intelligent data management helps you discover, cleanse, prepare, and protect sensitive data at the speed of business.
Learn about compliance considerations from a variety of viewpoints: privacy experts, customers, and even Informatica’s Deputy General Counsel. Start with one webinar or watch the entire collection to get insights that can help you close readiness gaps.
Solution: Create end-to-end workflows to visualize the processes and activities that link physical systems to data categories, purpose, and third-party sharing, making the data flow more transparent so you can begin to quickly find and assess the requested data.
Solution: Completely remove personally-identifying information from systems with remediation that includes deletion workflows, and use validation capabilities to assess data against retention policies, and/or create an audit trail to verify the data has been removed or deidentified.
Solution: Matching requests collected from feeder systems to the trusted profile of a specific individual and that individual’s related data, wherever it exists across the enterprise, and run data subject access request (DSAR) discovery reports to determine where the subject’s data is being used.
Solution: Orchestrate the automated deployment of data security controls to mask personal data, help prevent unauthorized access, and monitor for suspicious use. Comply with requirements for data anonymization through deidentification without slowing down business.
Solution: Efficiently support access requests by using real-time insights about an individual’s in-scope personal data to quickly match that data with its purpose.