Getting Started: Five Steps to Start Your CCPA Privacy Program

Effective January 1, 2020, the California Consumer Privacy Act (CCPA) introduces new data privacy rights for California residents – forcing companies that conduct business in the state of California to implement structural changes to their privacy programs. According to research done by OneTrust and the IAPP, two of the biggest obstacles organizations face when it comes to CCPA preparedness is a lack of time and bandwidth, followed by the complexity of the law and uncertainty as to what the final requirements will be.

As a result, many organizations are beginning to prepare now, by replacing spreadsheets and traditional risk management solutions with modern data automation technology and powerful research portals that are purpose-built to solve these challenges at scale. This approach allows organizations to simplify the process.

This whitepaper provides practical steps you can take now to prepare for the CCPA and leverage the new law as a stepping stone to build a global privacy program.

The first step to take toward compliance is to understand the CCPA. At a high level, the CCPA gives consumers – defined as natural persons residing in California – several rights with respect to the personal information businesses sell or collect about them. Personal information is defined very broadly as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

The rights outlined in the CCPA will require companies to adapt their privacy programs to comply with the law. Some of these rights include:

Once you have a clear idea of the areas within your privacy program that need to be created or adjusted, you can begin to prioritize your next steps accordingly. Here are some common questions to consider as you determine your needs:

• How will our organization intake and process consumer requests?

• How will our organization verify the identity of the consumers?

• What is the best way to track third parties our organization has shared or sold information to?

• How will our organization notify third parties of consumer opt out or deletion requests?

• How will our organization handle "Do Not Sell" when a consumer opts out?

• What is the best way for our organization to manage and update our privacy disclosures and notices?

Many organizations adopt an incremental approach to their implementation, starting with a strong foundation to support compliance throughout the life of a privacy program. Having a clear understanding of how your organization plans to handle the intake and fulfillment of consumer rights requests, as well as understanding where personal information is distributed across your organization through a comprehensive data map, will be necessary steps in your CCPA compliance journey.

Now that you’ve adequately assessed your needs and your priorities have been mapped out, you can begin implementing your CCPA privacy program. This can be a daunting task, especially if your organization doesn’t have a privacy program in place just yet. To simplify the process, start with these five practical steps to prepare:

1. Build a Data and System Inventory

2. Leverage a Consumer Rights Requests Internal Process & Checklist

3. Include a "Do Not Sell My Personal Information" Button

4. Create a Process to Honor "Do Not Sell" Requests

5. Review and Update External Privacy Disclosures and Notices

The first, and probably the most critical step to start now, is to map where you hold personal information and how it flows throughout the organization. Data Mapping Automation technology is a core asset for those seeking to prepare for the CCPA – providing the data understanding you need to adhere to the new requirements of the CCPA, such as responding to consumer access and deletion requests. The only effective way to meet consumer rights requests for information, deletion and opt outs of the sale of information, is to know where it’s housed, how it’s used, whether or not it’s sold, and in the event that it was sold, who it was sold to.

Without a data inventory and map, your organization will lack an understanding of what data it holds and how it is used throughout your organization. Lacking this insight, your organization will likely struggle to efficiently and properly respond to a consumer request for access or deletion of personal information.

If your organization went through this process in preparation for the GDPR, then you have a leg-up as much of the work can be leveraged for the CCPA, however, many organizations will need to not only refresh the process if their data map was built 12+ months ago in preparation for GDPR, but must also add some additional components specific to the CCPA – for example, details relating to household and device information as well as whether or not information was considered to be “sold” in the transfer to a third party.

For organizations starting from scratch, consider ways in which the data mapping process can be done in a way that is scalable and easy to maintain over time. Consider the following:

• Understand where personal information resides and flows within your organization.

• How to answer and implement consumer rights requests properly.

• Identify where personal information associated to an individual is located.

• Identify where personal information was disclosed or sold to third parties.

Under the CCPA, when a valid consumer request for information is submitted, an organization has 45 days to respond. Without an internal process in place, it can make it difficult to adhere to this timeline or to even process a request at all. Utilizing the right tools can help your organization craft an efficient workflow to adhere to the 45-day response timeline and even offer a simple way to request a 90-day extension if necessary. A thorough process and toolkit can help your business streamline, and even fully automate, the intake and fulfillment of requests for personal information.

When creating your internal process and checklist it’s important to think through the workflow once a consumer exercises their rights. Consider the following:

• Do you have a way to track and ensure you meet the 45-day timeline?

• Do you have a process in place that will allow you to track and limit the number of requests to two in a 12-month period?

• How will your verify the consumer's identity?

• Once those requests are verified, do you have a way to dynamically route the requests to the appropriate system owners or automatically pull, update, and delete the information from the target systems?

People around the world are taking advantage of new individual rights to request access to or deletion of their personal information. Creating a process and finding the right tools will help your organization manage these compliance requirements while creating a systematic way to fulfill these requests in a timely and automated manner.

Under the CCPA, all consumers have the right to opt out of the sale of their personal information. This is enabled by adding a “Do Not Sell My Personal Information” link to your website. Moreover, organizations should have a way to verify that they are effectively respecting consumer opt outs, as well as documenting the details in the process. The CCPA outlines the following legal requirement relating to consumers’ “Do Not Sell” rights:

When creating your internal process and checklist it’s important to think through the workflow once a consumer exercises their rights. Consider the following:

• Consumer’s right to direct business “Do Not Sell My Personal Information”

• Business obligation to provide notice of right to opt-out

• Respect opt-out for at least 12 months before requesting authorization to sell PI

• Opt-out can be requested at any time

• Does not require account creation to opt-out

• No third party resell without notice and opt-out

• Restriction on sale of personal information of consumers under 16

  • Opt-in for those under 16

  • Consumers under 13 must have parent/guardian opt-in

Also, keep in mind that the definition of “sale” under the CCPA does not relate to monetary exchanges alone. Per the law, sale is defined as, “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information to another business or a third party for monetary or other valuable consideration.” In other words, any benefit you may receive by sharing or providing personal information to a third party is considered a sale under the CCPA – for example electric car companies receiving tax benefits by disclosing the Vehicle Identification Numbers of vehicles sold.

When thinking through your organization’s process for handling “Do Not Sell” requests, consider the following:

• Add a “Do Not Sell My Personal Information” link to the website

• Determine the information needed up front

• Dynamically route requests and update downstream systems to prevent unauthorized sales of information

• Track requests to enable re-engagement after a 12-month period

There are solutions available that will help your business facilitate these requests and streamline the process. For example, if a customer clicks the “Do Not Sell” link on your website, you can lead them to a customizable web form that allows them to opt out of the sale of their personal information. Documenting consumer opt outs is also a crucial step in the process to demonstrate compliance with the CCPA, so it’s important to find a tool that can assist with tracking this information and syncing consumer records to your other technologies to avoid the accidental and unauthorized sale of consumer data.

By taking the time to create a process for handling “Do Not Sell” requests, your organization will empower consumers to take more control over their settings, creating a better experience, and more personalized marketing

In preparing for the “Do Not Sell My Personal Information” requirement, putting the link on your website is only the first step, the challenge lies in what happens after an individual clicks the link. This is where your organizational process is so important. Determining what tools and tactics your organization will leverage to comply with these requirements will help streamline your approach and help to simplify the compliance process. When thinking through your process, consider the following:

• Leverage cookie banners to provide notice at the point of collection.

• Enable opt-out for tracking/analytics that is typically sent to third parties via cookie preference centers.

• Dynamically drive consent model based on reverse IP lookup.

Many organizations are leveraging a similar intake form to the requests for information and deletion, so we can capture some information up front to help us facilitate the request and update downstream systems to prevent the sale. You need to evaluate the systems that store information that gets sold to see if there is a field or a column to flag when an individual has opted out – many are trying to flag opted out customers vs. just deleting the information so that you can re-engage them after the 12 months has passed.

While there isn’t a provision in the CCPA that says you must have a cookie banner on your website, as with the ePrivacy Directive, many organizations consider the information they collect in cookies to fall within the scope of the CCPA’s definition of sale of personal information, and therefore leverage cookie banners not only as a way to provide notice at the time of collection, but also utilize cookie preference centers as a way to allow consumers to opt-out of different categories of cookies, such as targeting or analytics cookies.

Under the CCPA, organizations’ privacy policies must inform consumers about how data is being used and shared. Additionally, policies must be updated at least every 12 months and contain information about the categories of personal information being collected, whether personal information is sold to third parties, and more. When updating your privacy policy, consider the following:

• Ensure privacy notices include consumers’ rights under the CCPA and direct consumers to a consumer rights request intake form.

• Ensure privacy notices include the categories of information collected, sold, and disclosed.

• Explicitly state in the privacy notice if no personal information is sold.

• Create a reliable schedule and process to ensure privacy policies are reviewed and updated every 12 months.

In addition to the new disclosure requirements for businesses that collect, sell, and/or disclose the personal information of California residents, the CCPA also outlines disclosures organizations are required to make when they receive a verifiable consumer request. This includes:

• the categories of personal information the business has collected about the consumer;

• the categories of sources from which that information about the consumer was collected;

• the business/ commercial purpose for collecting or selling the consumer’s personal information;

• the categories of third parties with whom the business shares personal information; and

• the specific pieces of personal information the business has collected about that consumer.

Having a system in place to identify, track, and easily update policies and disclosures will be key in streamlining your process and help ensure that your organization is maintaining CCPA compliance.

Like any regulation, there is an expectation that there will be updates to the rules issued in the CCPA, so keeping up with these regulatory changes is key to remaining CCPA compliant. This is an area where your internal CCPA team can assist by staying informed of any updates or changes to the law and working to adapt your privacy plan accordingly.

Leveraging the practical steps in this guide is a great place to start, regardless of the maturity of your privacy program. Spend some time determining your internal processes for handling consumer requests and begin training your organization on best practices and expectations. With OneTrust, your organization can simplify CCPA compliance with a suite of custom-built tools and technology, implemented by our CCPA Professional Services team and enhanced by the CCPA global user community and advisory board. With OneTrust for CCPA, your organization can:

• Pinpoint where personal data resides and how it is used.

• Streamline your ability to act when consumers exercise their rights to information and deletion.

• Manage opt outs relating to the sale of personal information.

The OneTrust platform directly addresses CCPA requirements and sets organizations on the right trajectory for supporting a global privacy program. Contact one of our privacy experts to get started with your US privacy implementation.

Built for Global Privacy Compliance

OneTrust is built for global privacy compliance, not solely CCPA compliance. This enables organizations to take a more comprehensive approach to privacy compliance. The tools are comprehensive in nature and serve to fulfill a wide range of privacy compliance challenges. Together, the tools deeply integrate, making OneTrust a powerful, single-pane-of-glass privacy compliance solution.

Customizable Templates & Flexible Workflows

OneTrust offers unmatched flexibility with customizable assessment templates and workflows to fit diverse use cases.

Scalable Architecture to Fit Business Requirements

OneTrust works for small to medium organizations, as well as massive, multi-national enterprises. The tools employ a customizable organizational hierarchy and powerful role-based access controls, offering your organization the ability to scale while maintaining a clear separation of duties.

Trusted by Thousands of Organizations Worldwide

More than 3,000 customers, including 200 of the Global 2,000, use OneTrust to comply with data privacy regulations across sectors and jurisdictions, including the California Consumer Privacy Act (CCPA), EU General Data Protection Regulation (GDPR), and other global privacy laws.

Software Available in 60+ Languages

OneTrust has an in-house team of translators, making the OneTrust software available in 60+ languages.

Team of Dedicated Privacy Professionals

Combined, the OneTrust team holds more than 300 privacy certifications from the International Association of Privacy Professionals (IAPP).