CCPA vs GDPR: Data Privacy in Motion

The need to protect the consumer’s data privacy has increased significantly over the last several years. This need has given rise to several data privacy laws and regulations, two of which (CCPA and GDPR) we are going to discuss in this article.

There’s a lot to cover, so let’s get started.

Data Privacy Throughout the Years

Privacy was always a thing that people wanted to protect, whether from a nosy neighbor, or their ruler.

The US Constitution, a document written in 1789, for instance, covers privacy in the 4th Amendment, which states that:

“The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated and no warrants shall issue, but upon probable cause, supported by oath or affirmation and particularly describing the place to be searched and the persons or things to be seized.”

In 1948, the United Nations General Assembly issued the Declaration of Human Rights, whose Article 12 says:

“No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attack upon his honor and reputation. Everyone has the right to the protection of the law against such interference or attacks.”

The problem was that such laws were too few and far between to make a difference.

One of them was the Privacy Act of 1974, which established a Code of Fair Information Practice on the collection, maintenance, use, and distribution of personally identifiable information (PII) by federal agencies in the United States.

Across the pond, in Europe, the EU countries arguably were paying even more attention to their citizens’ right to privacy and established the EU Data Protection Directive in 1995.

What is CCPA vs GDPR: Overview

Both of the aforementioned laws, the Privacy Act of 1974 and the EU Data Protection Regulation, will prove instrumental in creating the two laws that we are discussing today: the California Consumer Privacy Act and the GDPR.

The California Consumer Privacy Act (CCPA) took effect on January 1st, 2020 and it applies to any business that deals with primarily consumers in California.

Its three core principles include:

1. Transparency
2. Accountability
3. Control

On the other hand, the EU’s General Data Protection Regulation (GDPR) applies to any entity (individuals, NPOs, or businesses) that collect and process data from EU consumers.

The GDPR also identifies some key principles:

1. Lawfulness, Fairness, and Transparency
2. Purpose Limitation
3. Data Minimization
4. Accuracy
5. Storage Limitations
6. Integrity and Confidentiality
7. Accountability

CCPA vs GDPR: Key Similarities

Although the terminology between CCPA and GDPR differs, the two laws share many similarities (CCPA is often called “the California GDPR”), especially when it comes to:

Their Goal

Both laws aim to protect consumer’s data privacy in their respective regions (California and EU) and of people of its residents.

Whether they call it “personal information” (CCPA) or “personal data” (GDPR), both GDPR and CCPA mean the same thing: information that can be used to identify a person.

CCPA defines a service provider as a “for-profit legal entity that processes information on behalf of a business.

On the other hand, GDPR uses the term “data processor” and by this means “a person or organization that processes information on behalf of the data controller”. So, even though the names they use are different, both the service provider and the data processor do the same thing process information on someone else’s behalf.

Neither CCPA nor GDPR is limited to their respective territories. Instead, CCPA applies to anyone who does business in the state of California, US, whereas GDPR applies to anyone who offers goods and services to consumers in the EU.

In other words, a business does not have to be in California or the EU for the CCPA or GDPR to apply to them.

Not all consumer rights are equal under CCPA and GDPR since in general, the GDPR has a broader scope.Still, both laws include:

• Personal Information or Personal Data
• Service Provider or Data Processor
• Extra-Territorial Scope
• Certain Consumer Rights
• Right to access information
• Right to delete/erase information
• Right to data portability
• Right to opt-out/object

CCPA vs GDPR: Key Differences

However, there are many more differences between them, especially in terms of scope and how they define certain things.

Here are the main differences between CCPA and GDPR

• CCPA is Statutory AND Regulatory, Whereas GDPR is Only Regulatory

The state of California does not need to enforce CCPA in case of a violation. Any such will automatically trigger it and the affected individual can file a civil lawsuit with the state court in CA.

On the other hand, the GDPR is a framework that individual EU members have to enforce through their own national laws.

• Individuals that it Applies to

Although both laws have an extraterritorial scope, the CCPA applies only to consumers who are residents of California and not in transit or temporarily there.

The GDPR, however, applies to any individual who is in the EU at the time of data processing, whether they reside there or are in transit

• Entities that it Applies to

CCPA applies to for-profit organizations that collect personal data from residents of California for commercial purposes

Whereas, GDPR applies also to any kind of entity that is involved in data processing activities, be it for profit or not

• Definition of “Personal Data”

Under CCPA, “personal data '' refers to “Information that identifies, relates to, describes, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with a particular consumer, device or household.”

For instance, this includes the individual’s location, biometric data (fingerprints, facial recognition, etc.), email address, and more.

However, it does not include things such as:

• Information that is already publicly available through federal, state, and local government records
• Medical information that is already protected by HIPAA and CMIA
• Personal information covered in the Gramm-Leach-Bliley Act (GLBA)
• Information in California’s Driver’s Privacy Protection Act (CDPPA)

The definition of “personal data under GDPR, however, is much broader and it refers to “any information relating to an identified or identifiable natural person (data subject)”.

Where, an identifiable natural person” is identified as “one who can be identified, directly or indirectly”.

Under GDPR, personal data includes:

• An individual’s name and surname
• Their home address
• Email address (if it includes the individual’s name and surname (like name.surname@email.com)
• ID number
• -Location data
• -Internet Protocol (IP) address
• -Cookie ID
• -Advertising identifier on the phone
• -Data held by the doctor that can be used to identify someone

On the other hand, GDPR does not consider the following as “personal data”:

• Anonymized data
• Email addresses that don’t include one’s name and surname
• Data that is related to a deceased person
• Non-EU recipient countries
• International Data Transfer

There are no restrictions to it under CCPA.

Non-EU recipient countries must provide adequate protection.

• Definition of Data Management

Under CCPA, “data management” includes:

• Data collection
• Data processing
• Sale of data

With CCPA, a business that collects data from consumers must provide them with a choice to opt-out via a “Do Not Sell My Personal Information” link on any page on their website where personal information is collected.

The GDPR, on the other hand, requires businesses to provide both an opt-in and an opt-out option on their website. That means a business that processes data must ask its consumers for explicit consent to use their data (opt-in) and also an option to revoke their consent at any time (opt-out).

Consumer Rights Under CCPA and GDPR

Consumers have certain rights under both CCPA and GDPR, although the EU law covers more rights.

Consumer Rights Under the CCPA

Under the California Consumer Protection Act, consumers have the right to:

1. Request information
2. Access data
3. Data disclosure
4. Delete data
5. Opt-out of data processing
6. Etc.

Consumer Rights Under the GDPR

Under the General Data Protection Regulation, consumers have the following rights:

1. To be informed
2. To access their information
3. To correct inaccurate data
4. To delete data
5. To object to personal data processing
6. To data portability
7. To access data
8. To restrict automated data processing for profiling and/or decision-making
9. Etc.

Exercising Consumer Rights

Consumer rights are exercised and enforced differently by the CCPA and the GDPR.

In California, CCPA enforcement is the domain of the Office of Attorney General (OAG), which is responsible for determining fines and penalties for CCPA violations.

The EU, in comparison, has established the Information Commissioner's Office (ICO) as the primary enforcement body for GDPR.

CCPA vs GDPR: Consequences of Non-Compliance

Both CCPA and GDPR impose fees and penalties in case of a violation.

CCPA Fines & Penalties

Under the California Consumer Privacy Act, the fines are imposed by the state court of California and can be up to $2,500 per violation or $7,500 per intentional violation.

Also, the CPRA, which acts as an amendment to the CCPA as of January 2023, imposes a penalty of $7,500 for any violation relating to minors under 16 years of age

Finally, can also claim statutory damages of a minimum of $100 and a maximum of $750 per violation.

GDPR Fines & Penalties

The General Data Protection Regulation defines two levels of fines based on their severity:

• Less severe violations cost the perpetrator up to €10 million or 2% of the business’s annual global turnover (whichever is higher)
• While more severe violations cost up to €20 million or 4% of the business's annual global turnover (whichever is higher)

CCPA and GDPR: Compliance Requirements

Compliance with both CCPA and GDPR is important in two ways:

1. It ensures that your business handles consumer’s personal data in a safe and responsible manner
2. It sets a standard that everyone has to follow, regardless of the size, thus creating a level playing field (at least in this)

Let’s take a look at the difference between GDPR and CCPA requirements next:

CCPA Requirements

A business is required to comply with CCPA if it:

1. Collects personal data of California residents
2. Collects data for commercial purposes on a minimum of 50,000 consumers
3. Selling products or services accounts for at least 50% of its annual revenue
4. Has an annual gross revenue income of $25 million or more

So how can you ensure CCPA compliance?

Here’s a checklist that can help you:

Have a Clear Data Privacy Policy on Your Website

You must be fully transparent about:

• What data do you collectWhy you collect it
• How you process dataHow (methods) users can request access to their data, move, change, or delete dataHow you verify the identity of the person submitting a request
• How users can opt-out (a clear “Do Not Sell My Personal Information” link

Full Disclosure

If you sell or share personal data of consumers with third parties, you must inform them about it.

A good way to do this is via a consent management pop-up or banner on your website homepage that users will see when they visit it.

Obtain and Store Consent

Consent can be obtained directly if the person is over 13 years of age or from a parent or legal guardian for children under 13 age

Offer a Way for the Consumers to Contact You

You must provide a clear and unambiguous way for consumers to contact you if they want to, for instance, request access to their data, rectify data, or delete data.

As well, you must reply to such requests without delay. One way to ensure that your organization’s privacy practices are up to the standards is to appoint a CCPA DPO.

GDPR Requirements

If you are:

1. A business (whole or a branch) located in the EU that processes personal data of consumers or
2. A business outside the EU that provides goods or services to consumers in the EU or
3. Monitor the behavior of consumers in the EU,

You are required to comply with the GDPR

To ensure GDPR compliance, you can use the following checklist:

Understand how Data Flows Through Your Company

A business that doesn’t understand and can’t explain how data flows through its systems will have a hard time controlling that data and being compliant with GDPR.

This is why you must keep a record of the following:

• The type of personal data recorded in each department
• How does each department process data?
• Who is responsible (per department) for data processing?

Include a Clear and Transparent Privacy Policy on Your Website

Your privacy policy must include answers to the following questions:

• How do you gather data?
• Do you have a lawful basis for gathering data?
• Your purpose for gathering data?
• The timeframe you will keep that data
• What rights do the users have?

Appoint a DPO

A DPO or a “Data Protection Officer” is a person in your company who is responsible for overseeing your data protection strategy.

Only Collect Data That You Actually Need

You can’t collect data on a “might be useful one-day” basis. Instead, you must have a clear purpose for it and must only collect data for that purpose.

In addition, once that purpose is fulfilled, you should no longer hold that data and should delete it.

Verify the Age of Users Giving You Consent

You can only process data from persons over 16 years of age under GDPR.

If there are users under 16 years of age that might interact with your website, you must have an age verification process on it.

For processing data from users under 16, you must obtain consent not from them, but from their parents or legal guardians.

Assess Third-Party Risks

If you’re also sharing consumers’ personal data with third-party vendors, you need to first be aware of the security risk they might pose.

Evaluate each vendor that you share data with for potential security vulnerabilities.

Report Data Breaches

The General Data Protection Regulation makes it mandatory to report data breaches within 72 hours.

Any data breach must be reported by the data processor to a data controller, who in turn reports it to the supervisory authority.

A supervisory authority, called a Data Protection Association (DPA) is located in the EU state that the business is based on and is responsible for enforcing GDPR compliance.

FAQs

How is GDPR Different from CCPA?

GDPR applies to any entity (for-profit or NPO) that processes the personal data of consumers in the EU, whereas CCPA applies to for-profit companies that offer products and services to consumers in California.

In addition, GDPR requires both an opt-in and an opt-out, while CCPA only requires an opt-out.

What is the California GDPR-Like Law?

The California Consumer Privacy Act was introduced in 2018 and serves to give consumers in California more control over how their personal data is collected and used by businesses.

What is the US Version of GDPR?

Unlike the EU, which has the General Data Protection Regulation, the United States doesn't have a privacy law that applies to its entire territory.

Instead, each state has its own privacy law, such as the CCPA in California, the Utah Consumer Privacy Act, or the Colorado Privacy Act.

Is GDPR Valid in the US?

GDPR applies to businesses outside the European Union (in the United States for instance) as long as they offer goods and services and process data of EU citizens.

Is CCPA Applicable Outside of California?

Yes, the California Consumer Privacy Act applies not only outside of California but outside of the United States as well as long as the business processes data of Californian citizens.

Does GDPR Apply to Non-EU Citizens?

The General Data Protection Regulation was developed to protect the personal data of EU citizens and give them more control over it. It does not, however, apply to non-EU citizens.

For instance, GDPR wouldn’t apply to a consumer in Switzerland as it is not an EU member.

Does GDPR Apply in the UK?

Since the United Kingdom is no longer a part of the European Union, the EU GDPR no longer applies in the UK. However, the UK has its own version the UK GDPR which is based on the EU GDPR, only smaller in scope and modified for the UK law.

Closing

According to the Pew Research Center, most Americans don’t think they have control over how companies or governments collect their data. This is why laws such as CCPA (in California) or GDPR (in the EU) hold such importance.

Need help complying with CCPA or GDPR?

Captain Compliance can assist you in getting CCPA and GDPR compliance on your website and protect your consumers.