Financial Service Providers and the CCPA: Analyzing the GLBA Exemption, Avoiding Damages for Noncompliance

Description

California enacted the nation's most extensive consumer privacy law in 2018. The CCPA provides notice, access, erasure and opting out rights for California residents, as well as a private right of action in the event of a data breach. It places a significant burden on the financial services industry (both banking, nonbank lenders and fintech), where companies collect, aggregate, analyze, and move the consumer data at the heart of the law.

The CCPA exempts certain information subject to the GLBA regulations, but GLBA entities are subject to CCPA provisions and requirements if they collect, use, and disclose information that is not subject to the GLBA. So, GLBA-regulated entities using targeted online advertising, tracking web page visitors, and/or collecting geolocation data--to name a few examples--and their counsel must grasp the CCPA requirements.

CCPA regulations provide a private right of action for consumers to seek statutory damages of not less than $100 and not greater than $750 per incident if the consumer's information "is subject to unauthorized access, exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures and practices." GLBA-regulated entities are subject to millions of dollars of potential damages if they experience a data breach.

Listen as our authoritative panel discusses the CCPA and the extent to which financial services providers may be subject to CCPA notwithstanding the exemptions provided under the law for GLBA-regulated entities.