Earlier this year, Gov. Jerry Brown (D-California) signed into California law Assembly Bill No. 375—a definitive, broad new privacy law that leaves little room for interpretation.
The new law gives consumers the right to request a business to disclose:
- The categories and specific pieces of personal information that it collects about the consumer.
- The categories of sources for which information is collected.
- The business purpose for collecting information.
- The categories of third parties with which the information is shared.
The law also ensures consumers' right to control their personal information by ensuring they:
- Know what information is collected about them.
- Know whether their information is sold or disclosed and to whom.
- Can stop the sale of their information.
- Are able to access their personal information.
- Have equal access to service and price if they exercise their privacy rights.
How will it work? A business must provide consumers with at least two methods for submitting requests for information. At a minimum, a toll-free number and a website address are required.
Does my business need to comply with this law? The law applies to businesses that do business in California and satisfy one of the following thresholds:
- Gross revenue above $25 million
- Alone or in combination, annually buys or receives the personal information of 50,000 consumers
- Derives 50% or more of its annual revenue from selling personal information
What are the penalties for violating this law? The penalty for the release of unencrypted or unredacted personal information is between $100-$750 per consumer record lost, and possibly more at the discretion of the courts.
What does this mean for the rest of the country? Cybersecurity and data privacy are hot topics in the U.S. and the rest of the world. The European Union has enacted tough privacy laws, such as the General Data Protection Regulation, and California is the first state in the U.S. to follow suit. Other states are watching the effect of California's new legislation closely and may follow California's example in the near future.
Independent agents should take notice of this law and determine how they would react if their state enacted similar legislation.