We would like to ensure that you are still receiving content that you find useful – please confirm that you would like to continue to receive ILO newsletters.
24 May 2019
In June of 2018, California passed the California Consumer Privacy Act (CCPA), which seeks to give consumers additional safeguards regarding their personal information. The CCPA will become effective January of 2020 and may impact companies in the education sector, including the larger education technology companies.
While the CCPA does not apply to nonprofit educational institutions, it may apply to certain for-profit educational institutions, third-party service providers, and others in the education space. If an educational entity meets the threshold requirements below or it processes information on behalf of such an entity, it should prepare for CCPA implementation by January 2020.
The CCPA applies to for-profit businesses that collect the personal information of California consumers, and meets at least one of the following criteria: 1) annual gross revenue over US$25 million; 2) buys, receives, sells, or shares the data of over 50,000 California residents annually for commercial purposes; or 3) derives over 50 percent of its annual revenue from selling consumer information. The CCPA also applies to service providers that process consumer information on behalf of qualifying business entities.
The CCPA covers several different activities related to consumer information. First, the CCPA regulates the disclosures businesses must provide consumers before their personal information is collected and what businesses can do with the personal information. Second, the CCPA governs the sale of personal information, with "sale" defined very broadly to include data transfers in exchange for any valuable consideration. Finally, the CCPA oversees disclosure of personal information for business purposes.
Regulated educational entities should be wary of the following key requirements of the CCPA:
Business entities are not allowed to discriminate against consumers who exercise their rights under the CCPA. However, businesses are permitted to offer financial incentives for consumers to provide consent for the collection, sale, or deletion of their personal information.
Once in effect, the California attorney general's office will have jurisdiction over enforcement. Businesses have 30 days to cure alleged violations, if these are not cured, then the attorney general's office can levy civil penalties of up to US$7,500 per intentional violation. Unlike the Family Educational Rights and Privacy Act (FERPA), the CCPA authorizes a limited private right of action for consumers whose personal information is subject to unauthorized disclosure. But this private right of action only applies to disclosure of sensitive personal information that includes social security numbers, passwords, and medical information.
The CCPA provides consumers broad privacy rights. Though it is not applicable to all educational entities, many businesses in the education sector, including large education technology companies, should be aware of its requirements.
For further information on this topic please contact Bret S Cohen, Greg Ferenbach, Ray Li or Julian Flamant at Hogan Lovells by telephone (+1 202 637 5600) or email (firstname.lastname@example.org, email@example.com, firstname.lastname@example.org or email@example.com). The Hogan Lovells website can be accessed at www.hoganlovells.com.
This article has been reproduced in its original format from Lexology – www.Lexology.com.
The materials contained on this website are for general information purposes only and are subject to the disclaimer.
ILO is a premium online legal update service for major companies and law firms worldwide. In-house corporate counsel and other users of legal services, as well as law firm partners, qualify for a free subscription.