CCPA vs GDPR – Miscellaneous

00:01

welcome everyone to lessen 9.3.

00:03

There are a couple of differences between the C, C P A and the GDP are that do not fit nicely in the categories of legal basis of processing or the scope of consumer rights.

00:13

Therefore, I decided to create an additional lessen the miscellaneous differences between the two regimes to help drive your understanding of the CCP A a little bit better and also be able to differentiate the obligations you have. If your company is subject to the California consumer rights as well as the GDP are,

00:30

let's jump right into it.

00:32

The learning goals and objectives For this lesson, it's going to be a series of rapid fire fun facts

00:38

Objective number one.

00:39

We're going to talk about some of the differences between the history of the CCP A versus the GPR.

00:45

The differences between how the two regimes are enforced and some general industry trends and then also highlight a couple of unique obligations that exist under the GDP are but do not exist under the c c. P. A.

00:57

Keeping in mind that your company very well likely might have already performed some sort of GDP. Our compliance effort that will not apply to the c c p. A.

01:06

I want you to be alerted to that when it comes up at work.

01:10

The biggest difference in my personal opinion between the g d p r and the C C P. A. Is how they came about.

01:17

This is so fundamental to the actual obligations that the GDP are ended up establishing versus those of the C C p A.

01:25

The GDP are is the by product of two years of negotiations between representatives of all 27 members of the European Union in Brussels.

01:34

They were quite literally huddled up in a conference room for 24 months, pounding out which provision would be included in the GDP are

01:42

and those which would not.

01:44

We ended up seeing very well thought and mature frameworks that ended up becoming part of the G d. P. R. Because they were the byproduct of extended negotiations and, more importantly, because Europe simply had a much longer history of dealing with data privacy,

01:59

it's more ingrained in their legal culture as well as their political landscape.

02:04

The C C p A. On the other hand,

02:07

it was drafted in two weeks by the California Legislature.

02:09

As I mentioned to you, they took it out of the ballot initiative and, in general, the California Legislature's as well as frankly, the United States in general, with the exception of some of the sectoral laws,

02:20

is very new to privacy.

02:23

We see the difference in the obligations that companies are subject to because of simply how those laws came to be.

02:30

Let's move forward from that.

02:31

There are also massive differences in between how the GDP are is enforced versus the C C P. A. Is enforced.

02:38

Let's actually tackle the CCP a first.

02:42

As you remember in a previous module,

02:44

the C C P. A. Is Onley enforced by one agency,

02:46

the California attorney general, which is very new to privacy. It's poorly funded.

02:53

With all due respect to the California Legislature's.

02:55

They did not put in mechanisms to fund the California attorney general as they sought to enforce potential CCP, a non compliance obligations.

03:04

And in general there is a perspective that the court system in the United States is going to be able to handle most CCP issues,

03:10

particularly as it relates to breaches.

03:15

That concept doesn't really exist in Europe,

03:17

On the other hand, there are 27 highly mature, well funded supervisory authorities. Look no further than the information commissioner's office, the CEO in the United Kingdom,

03:29

the C N I. L. The Commission Nationale de Long for Matic, a daily buffet are France.

03:35

Those two agencies have been active for decades and enforcing privacy rights of European citizens well before the GDP are ever came to be.

03:44

That's a massive difference in terms of how seriously the your opinion, political and business frameworks take. The G d. P. R versus California.

03:52

We are, but in chapter one of a long journey,

03:54

whereas in the European Union this is very well developed.

04:00

The GDP are

04:01

it's got to be noted.

04:03

It was first, and that is also a key difference.

04:08

Why?

04:09

Because most multinational organizations I'm talking about the big companies with global footprints have already performed A GDP are build out,

04:16

which basically means the C C. P. A. Is second to the party,

04:20

and as a consequence of that,

04:21

if you work for a large company,

04:24

they are likely to view the CCP A as an add on for a second level effort

04:29

or even in business terms a second s o w statement of work.

04:33

The GDP are, however, will always be the starting line. The framework from which other data privacy obligations will thereafter flow.

04:43

It's not just by the way European residents and business operations in Europe that drive this.

04:47

There are other countries outside of the United States that are now positioning themselves to fall in line with the European standard.

04:55

Quick preview,

04:57

under the rules of the GDP, are AH country will be viewed as as adequate for the receipt of personal data of European residents.

05:03

If the protections that exist in that country are consistent with the protections that exist in Europe,

05:10

that's called an adequacy decision.

05:12

Feel free to look it up.

05:14

There are very important players in the global economy that are aggressively pursuing adequacy decisions like Japan and South Korea as well as Brazil,

05:23

which passed its own version of the GDP are it's called the GPD.

05:28

Basically, all that is to say

05:30

the GDP are is quickly becoming the global standard outside of the 50 United States.

05:35

Nobody and I really do mean no country is looking to the c c. P A. For inspiration.

05:42

Potentially, the other 49 US states. But

05:45

it's still been two years and no other US state as of this recording has passed a comprehensive privacy law.

05:51

So that really is a key difference. Right there is that the world is moving to the GDP are standard, not the U. S. Standard.

06:00

It also needs to be noted that the GDP are is far more feared.

06:04

There is a fantastic website. It's called enforcement tracker dot com.

06:10

You can follow the GDP are finds that come out

06:13

generally there is one issued every week or so, but sometimes they happen. They come in spurts.

06:18

Since the GDP are has gone live in May of 2018, there have been 395 fines

06:25

that date

06:26

August of 2020. It can be updated with the fall. Number is actually later in time, but the total value of fines there that is accurate. I just checked it.

06:35

€255 million in fines stemming under the GDP are,

06:41

and it's hard to keep track of every single fine and as of August as of November,

06:46

it doesn't really matter.

06:46

The point here is my friends, that the GDP are is responsible for serious fines.

06:53

Again, remember, up to 4% of global revenue could be the hammer,

07:00

the C C p A. On the other hand,

07:01

the jury's still out.

07:03

There haven't been any fines yet issued by the California attorney general again, as of this recording,

07:09

therefore,

07:10

the total value of fines is zero.

07:13

The only thing that's really sitting out there is that there are 14 CCP a lawsuits that are going but again, that's only because of data breaches.

07:20

There's another 78 lawsuits sitting out there that have the CCP is a sub component. But

07:26

that's not the main point of the claim

07:29

to bring this home.

07:30

We're about running here on time, but the GDP are absolutely has extra obligations that companies do need to keep track of

07:38

data minimization requirements.

07:41

You need to restrict the amount of information that your company collects unless there's a need to do so.

07:46

The GDP are requires that companies performed privacy impact assessments.

07:50

Basically, it's identifying the rights and protections of individuals whose information is collected.

07:57

C C p A. Doesn't care it all about that.

07:59

Not enough time to break down all six additional GDP, our obligations. But just keep a note. It's a heavier lift to comply with the GDP. Are

08:07

feel free to posit video there. If you wanna look at that more

08:13

in summary,

08:13

the history of the CCP versus the GDP are

08:16

we see very clearly that industries have shifted to the GDP are standard.

08:20

Why?

08:22

Because it's scarier and they're significantly more robust obligations.

08:26

That concludes the difference between the C C P A and the GDP are