GDPR Comparison: The California Consumer Privacy Act of 2018

Understanding the Privacy Landscape: Comparing the CCPA and GDPR

In our ongoing Privacy Tracker series, we aim to align diverse data protection laws with the EU’s General Data Protection Regulation (GDPR). This installment features an engaging comparison of California’s landmark legislation, the California Consumer Privacy Act (CCPA), enacted in 2018, against the GDPR. The intent here is to illuminate areas where compliance efforts might overlap and streamline operational endeavors, particularly for organizations navigating both regulations.

1. The Global Data Protection Stage

The backdrop of this comparison is significant. The GDPR is widely recognized as the gold standard for data protection laws globally, compelling organizations to enhance their data practices across various jurisdictions. While the CCPA stands as the first comprehensive U.S. data protection law, its long-term impact remains to be seen. Given California’s economic prominence and tech influence, the CCPA could very well shape the future of privacy legislation in the U.S.

2. Territorial Scope: Cross-Border Implications

Both the CCPA and GDPR extend their reach beyond their respective geographical confines:

• GDPR: This regulation applies broadly to organizations established in the EU, regardless of where the data processing occurs. Non-EU entities offering goods/services or monitoring behavior of EU individuals are also held accountable if they process personal data of those individuals.

• CCPA: This law applies to businesses “doing business” in California, regardless of their physical location, provided they handle the data of California residents. While there’s a narrow exception for activities conducted completely outside the state, businesses that do not meet the CCPA’s operational criteria can sidestep its obligations.

3. Material Scope: What’s Covered?

Diving into material scope, the CCPA and GDPR diverge notably:

• GDPR: The regulation focuses on three key roles: controllers, processors, and data subjects. Controllers define how data is processed, while processors act on behalf of controllers. GDPR compliance heavily burdens controllers, but processors also encounter considerable requirements.

• CCPA: This law introduces concepts such as “businesses,” “service providers,” “third parties,” and “consumers.” The rights conferred by CCPA mainly target “businesses” that meet specific revenue or data-handling thresholds. What constitutes “personal data” under the CCPA is expansive and includes various identifiers, potentially exceeding what is defined under GDPR.

4. Data Processing Principles: What’s Enforced?

A striking difference lies in the absence of explicit data processing principles in the CCPA.

• GDPR: Established principles guide how personal data must be processed, focusing on legality, fairness, and purpose limitation. It mandates strict compliance from organizations handling personal information.

• CCPA: In contrast, the CCPA imposes fewer internal restrictions on businesses, which may come as a surprise. Although the California Attorney General is tasked with issuing guidance to clarify these processes, businesses must currently assess their compliance with minimal constraints on how they manage personal data.

5. Lawful Basis for Processing: A Key Distinction

Under the GDPR, organizations must justify their data processing under one of six lawful bases, making the act of processing inherently conditional.

• CCPA: Lacking a similar requirement, the CCPA permits broad data processing. However, it institutes consumer rights to opt out of the “sale” of personal data, differentiating itself from GDPR’s more prescribed processing protocols.

6. Data Subject Rights: A Comprehensive Overview

While both laws confer substantial rights to individuals, the rights outlined differ considerably in application and intent:

• GDPR: Offers an extensive set of rights, including access, rectification, erasure, and the right to data portability, among others.

• CCPA: This law provides six rights for California residents, including the right to know about data collected and the right to request deletion, although the latter only applies to data collected directly from the individual. Rights to know what has been shared further complicate compliance, as businesses must distinguish between different types of data sharing.

7. Enforcement Mechanisms: Who Holds the Power?

Both the CCPA and GDPR assign enforcement authority to respective governmental bodies:

• GDPR: Fines can be severe, reaching up to 4% of a business’s global turnover or €20 million, depending on the nature of the infringement.

• CCPA: The California Attorney General oversees enforcement, with civil penalties of up to $7,500 per violation. Interestingly, the CCPA allows a private right of action solely for data breaches, presenting unique litigation opportunities but differing fundamentally from GDPR’s holistic enforcement strategy.

8. Penalties: The Cost of Non-Compliance

The repercussions of failing to comply with these regulations serve as a critical motivator for businesses:

• GDPR: Non-compliance can result in substantial financial penalties that could threaten organizational sustainability.

• CCPA: While it imposes civil penalties, it uniquely allows individuals to pursue damages in cases of data breaches, introducing substantial potential liabilities for companies operating in California.

9. Summary of Terms: A Quick Reference

For clarity, here’s the breakdown of core terms under both regulations:

In Conclusion

The landscape of data protection is evolving, and as organizations grapple with divergent regulations like the CCPA and GDPR, understanding these critical differences becomes paramount for effective compliance management. Each law offers varied obligations and consumer rights; therefore, businesses must tailor their compliance strategies to align fully with both frameworks, avoiding any assumptions that adherence to one implies compliance with the other.