Privacy & Cybersecurity: Navigating digital privacy

Consumer privacy and data security are two of the most vital topics facing California auto dealers and other retailers today. This blog explores the changing legal landscape, what it means for retailers, and how to take a practical approach to issues when perfection may be unattainable. Look to here for updates on new laws and regulations, enforcement actions by regulators and the plaintiff’s bar, and steps you can take to decrease liability and increase customer confidence.

Understanding the CCPA, part 5

What does the law require?

Published on

The California Consumer Privacy Act has four major prongs intended to protect consumer’s privacy while also allowing consumers to use services provided by companies that share and sell data. In general terms, businesses will need to tell customers what type of data they collect, what they disclose or sell, and what purpose they use the data for. Businesses may also be required to erase data and, in more limited circumstances, allow customers to “opt out” of certain usages.

Understanding the CCPA, part 4

What kind of data uses are restricted?

Published on

The California Consumer Privacy Act governs three different types of data usages: collection of data, disclosure of data, and sale of data. It is important for businesses, including auto dealers, to know not only what type of data they are collecting, but what use they intend to put it to, as their duties under the law depend on the data usage.

Understanding the CCPA, part 3

What kind of data is covered?

Published on

The California Consumer Privacy Act applies to “personal information” of a consumer, broadly defined as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Data covered includes, but is not limited to, traditional identifiers like name, postal address, email address, driver’s license numbers, and social security numbers. It also personal characteristics such as age, race, or national origin; commercial information such as records of purchases of goods or services; biometric data; Internet or other electronic network activity; geolocation data; professional or employment-related data; and education information. However, “publicly available information,” defined as information lawfully made available from federal, state or local government records.

Understanding the CCPA, part 2

What types of businesses does the law apply to?

Published on

Big tech companies are the clear target of the California Consumer Privacy Act, but its reach is much wider than just Silicon Valley. The threshold question, therefore, for each business looking at CCPA compliance, including auto dealerships, is whether the law applies to them. Not all businesses are covered by the CCPA; understanding whether your is will be key.

Published on

On October 10, 2019, California Attorney General Xavier Becerra released proposed regulations to implement the California Consumer Privacy Act. These regulations focus on one aspect of the CCPA, the consumer’s new rights under the law, and give businesses guidance on how to effectuate these rights and comply with the law. This now triggers the process of public comment and finalization of the rule, which will extend into 2020.

Understanding the CCPA, part 1

Background and politics

Published on

In June of 2018, on the last day to qualify ballot measures for the 2018 ballot, California adopted AB 375, the strongest privacy law in the nation. The new law is modeled somewhat on the European Union General Data Protection Regulation (GDPR), which famously purports to give customers the “right to be forgotten,” and gives consumers several new rights, aiming to bring more control and transparency to the murky trade and use of people's personal data. It also, for the first time, provides consumers with the ability to sue companies that mishandle their data without ever having to prove harm due to the misuse.

Published on

The type of biometric privacy lawsuit filed last month against a Hilton Hotel in Chicago is a harbinger of privacy litigation to come—but a very similar case is not likely to come soon to California, where the recently minted California Consumer Protection Act (CCPA) excludes employees like the plaintiff against Hilton.

Data breaches continue to make the news

Take action to secure your customer data

Published on

In recent weeks two data breaches have made headlines across the country, once again drawing attention to the need for businesses to take steps to safeguard customer data. Dealers have a legal obligation to safeguard their customer’s information under both federal and state law, in most jurisdictions. These breaches may also increase the salience of data security issues for customers, meaning that your customers may start to ask questions about how you will protect their data and demand good answers. With the legal obligations aligning with customer expectations, now is the time more than ever to act.

Published on

The California Consumer Privacy Act (CCPA), which was enacted in June of 2018 and will go into effect on January 1, 2020, is likely to undergo additional changes as the California Legislature enters the final stretch of the legislative year. We have previously updated you on legislation supported by the California Attorney General that would expand the scope of the law and increase consumer’s opportunities for consumers to bring lawsuits for alleged violations of the law. The good news is that the worst aspects of these proposed changes were defeated in committee and will not be enacted this year. The bad news is that some of the more important proposed business-friendly protections have been narrowed.