The California Consumer Privacy Act (CCPA) has been enforced by the California Attorney General since July 1, 2020.  The CCPA is designed to protect the personal information of California consumers, which is broadly defined as information that “identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”

The CCPA affects companies that store personal information on California consumers, even if they are not located in California. The threshold for falling under CCPA enforcement, in addition to obtaining or using personal information on California residents, is:

• Having a minimum gross annual revenue of $25 million,
• Buying, sharing or receiving data on 50,000 or more California residents, or
• Deriving 50% or more of its annual revenue from selling consumers’ personal information.

With the recent election, voters in California have now approved the California Privacy Rights Act (CPRA), also referred to as CCPA 2.0. While the CPRA does not take effect until July 1, 2023, the new requirements will apply to personal information collected on or after January 1, 2022. The new CPRA takes the CCPA even further by updating the definition of a “business,” adding restrictions to the “sharing of data” and not merely the selling of personal information, establishing the California Consumer Privacy Protection Agency (CCPA), and expanding a consumer’s private right of action, among others.

There are still exceptions to the new CPRA. For example, background screening companies, who are considered Consumer Reporting Agencies (CRAs), must adhere to the Fair Credit Reporting Act (FCRA) and are strictly regulated with regard to consumer information. Operating under the FCRA exempts companies such as Hire Image from the regulations under the CCPA/CPRA when the information is provided to employers for employment purposes. Under the FCRA, CRAs must maintain strict privacy and data security policies and procedures when dealing with consumers’ personal information.

Click here for more information about the CCPA exception. Stay tuned for further updates and clarifications on California privacy in the upcoming months.

If you have any questions about your company’s role or the role of the background screening company under FCRA or the CA CCPA, please contact us to learn more.