The California Consumer Privacy Act (CCPA) is the most comprehensive and significant data protection regulation enacted in the United States. Giving the strongest privacy rights to consumers, it entered its enforcement stage on July 1. While only directly applicable to Californian residents, the state’s position as the world’s fifth largest global economy has meant that corporations across the world have had to rethink their approach to data processing and privacy.

Customer protection and data privacy rights

At its core, the CCPA provides individuals foundational rights regarding their personal data including: the right to opt out of having their personal data sold, the right to erase personal data both from first party sites and companies it’s been sold to, and the right to know what personal information companies have gathered. For California residents who exercise these rights, the CCPA specifies a non-discrimination clause, meaning that everyone is privy to the same services and price, regardless of whether they allow organizations to sell their data or not.

Intended to enhance consumer protection and data privacy rights, the CCPA takes an even broader view than GDPR of what constitutes ‘private data’ and lays out a variety of requirements for the management and security of consumers’ personal information. So, what exactly is meant by ‘personal information’ according to the CCPA?

Obvious examples include a person’s name, postal address, and passport number. But political convictions, health and fitness profiles, sexual orientation, personality characteristics, employment history, and inferences also count – provided they are not already publicly available in the form of an interview or self-published article, for example. This snapshot of some of the sensitive information that has to be monitored reveals the immense task ahead of organizations, which now have to keep track of exactly what information is logged, deduced, and sold on each and every consumer. And with the average internet user spending 6.5 hours per day online, the vast volumes of data that organizations have to monitor is adding up.

The clock is ticking: in the event that someone does request access to a copy of their personal data or asks for its erasure, organizations must acknowledge their receipt of the customer’s communication within 10 days and respond with a meaningful answer within 45 calendar days.

Providing data transparency

The CCPA’s goal is to equip consumers with increased knowledge of what happens with their data. Instead of restricting the collection of sensitive information, it aims to provide data transparency and accountability, allowing consumers to see their digital footprint and forbid the selling of their personal information. This is a major differentiator from other data privacy laws such as GDPR, in which European citizens actively have to consent to having their data collected in the first place. With the CCPA, data is always collected by first party sites – it is how that information is used, individuals’ right to view that data, and the erasure of that data which is the law’s central concern.

The consequences

If organizations fail to comply with the CCPA’s requirements, steep penalties will ensue, with additional fines able to be issued in the event of a data breach. While this act does not impose cyber security regulations, the California Attorney General can stipulate digital hygiene guidelines, with organizations liable for inadequate security procedures and practices which are disproportionate to the data under their care.

Each consumer can claim up to $750 per data breach – or the actual damages, whichever is greater. Meanwhile, the state can charge up to $7500 per person, per violation, if an organization’s conduct is deemed intentional. This quickly becomes expensive. Most significantly though, the regulation introduces the right for consumers to bring data privacy issues to court, where they can seek financial redress. This is conditional upon unauthorized access to their personal information resulting from businesses’ failure to implement reasonable security practices and procedures appropriate for the particular type of information.

The three central tenets of this law present minefields for organizations. Keeping track of large volumes of data at an individual level is necessary in order to fulfil these requirements. In the face of companies’ growing digital infrastructures, including recent surges in cloud, SaaS, and email usage, the potentially dispersed storage of sensitive information, and the increasing risk of cyber-attack, CCPA compliance has become an even more daunting task.

How can AI help?

Darktrace’s Cyber AI helps support CCPA compliance by providing 100% visibility into the movement of data throughout an organization’s digital infrastructure, including noting who accesses it. By using self-learning AI to learn the ‘pattern of life’ of every user across cloud, SaaS, email, and traditional networks, Darktrace’s Cyber AI can automatically alert security teams of threats in real time and take autonomous action when an access policy is breached. And while the California Attorney General gives businesses a 30-day period to assess and remediate alleged violations of the CCPA, Cyber AI provides real-time understanding of cyber incidents, including data exfiltration, which enables businesses to not only meet this CCPA requirement, but to limit the impact of emerging threats.

For organizations to comply with this regulation, they need to be constantly aware of all activity involving sensitive consumer data. The Model Editor within the Threat Visualizer, Darktrace’s user interface, provides security teams with the ability to track specific parameters for this targeted, continuous monitoring. Darktrace offers customizable compliance models for customers to specifically watch over and safeguard user data as stipulated by the CCPA. A tag can be added to devices, stating that they contain personal data protected under the CCPA. This means that when an external or internal data transfer is instigated on the given device, it will immediately be flagged to organizations’ security teams. The same happens in the event of any unusual activity.

Figure 1: CCPA tag in the Threat Visualizer

The reality is that organizations’ digital environments – and the consumer data stored within them – are too extensive to manage, keep track of, and protect without Cyber AI. And with California set to vote on the implementation of even stricter privacy regulations in the coming months, organizations will need complete digital visibility and the ability to easily identify and fight back against emerging threats in order to keep pace with changing requirements. Cyber AI is no longer a nice-to-have, but a necessity.

‍