Are You Ready to Comply with the California Consumer Privacy Act?
The CCPA goes into effect January 1, 2020, and real estate owners are not exempt from compliance.
“Tenants or residents want to be able to have the convenience to do everything from their phone,” Alison Bird, managing director at CohnReznick, tells GlobeSt.com. “With this new privacy law, the definition of personal information does or could encompass all of those uses. It isn’t just the standard things you think of, like name and address. It also includes household points that make up profiles, so when you are connecting between your phone and your thermostat, that is personal information that is theoretically captured under this law.”
The legislation only recently passed, and experts are still waiting on guidance from the California Attorney General to better understand what the new legislation will encompass. “People have been waiting for guidance from the Attorney General because it was passed so quickly, and there have been a lot of gray areas that people are struggling with,” says Bird. “Now, we are waiting for final regulation so that people know how to comply with the new law.”
However, the guidance isn’t likely to come before the law takes effect at the start of the year. “I think that the guidance will come after the law comes into effect,” Alycia Workman, senior associate general counsel at MRI Software, tells GlobeSt.com. “There are some provisions that have enforcement periods after the effective date. With the speed at which this was passed, it wouldn’t surprise me if the regulations were finalized after.”
While the guidance will help to clarify the legislation, ultimately, the CCPA will change the way that owners do business. “The guidance will change the way that people do business if they comply, and the question is how much latitude and leeway California will give them in terms of starting the enforcement process,” says Lisa Stanley, CEO of OSCRE, tells GlobeSt.com.
In the interim, Bird, Stanley and Workman are all prepping owners now on compliance. “There are still a lot of things that aren’t going to change,” says Workman. “We are advising our clients to take the steps to get compliant with what we can reasonably say isn’t going to change, and build in the flexibility to account for any changes that might happen on the fringe topics.”
To start, owners and real estate companies need to understand the data that they have and how they are using it. “No matter what, you are going to have to know what personal information that you hold so that you can disclose it in your privacy policy or erase it, if that is appropriate,” says Bird. “That is the first step, and it can be very time consuming.”
Even more than data mapping, as Bird describes, is data security. “The other big piece is the security side,” she says. “As of January 1, if there is a security breach, there is going to be a private right of action. This is going to be extremely costly and it is going to be the most immediate enforcement that can occur. I usually advise first, work on your security and second, do your data mapping. I find that people want to just fix their privacy policy, but you really can’t disclose what is required in your privacy policy until you actually know what information you are collecting, why you are collecting it and where it goes.”
Finally, owners should look at their supply chain and contracts with third party vendors to make sure that they are compliant with the legislation.