California Consumer Privacy Act: The Need for Data-Centric Security

Short Summary

New privacy regulations are reshaping both business operations and the technologies used to process and protect personal data. The California Consumer Privacy Act (CCPA), effective January 1st, 2020, raises requirements for collecting, processing, and selling personal information and is expected to influence organizations beyond California due to its extra-territorial scope. With severe penalties, including per-record fines and the risk of class action lawsuits, businesses must focus not only on compliance checklists but also on limiting the fallout from breaches and fraudulent data use.

Effective CCPA readiness requires more than consent tools. A comprehensive approach combines organizational measures—clear accountabilities, responsibilities, and controls led jointly by roles such as the Data Protection Officer (DPO) and Chief Information Security Officer (CISO)—with a portfolio of technologies. Six key actions are emphasized: discovering where PII resides; controlling access and processing; honoring opt-outs and gathering consent where needed; ensuring lawful data transfer and cloud processing; detecting and notifying breaches quickly; and maintaining adequate organizational and technical protections.

Discovery is presented as foundational because modern data ecosystems push PII from core systems into data lakes, analytics pipelines, and unstructured outputs like Excel files and PDFs, making deletion requests and governance difficult once data sprawl occurs. Data-centric security—especially tokenization, format-preserving encryption, and data masking—helps anonymize data, reduce exposure, and preserve application functionality. Tokenization is highlighted for maintaining data format while limiting uncontrolled proliferation, forcing explicit re-identification requests under stronger controls and thereby improving both compliance and broader cybersecurity resilience.

Interesting Facts

• CCPA became effective on January 1st, 2020.
• CCPA was signed into law in June 2018 as part of the California Civil Code.
• CCPA includes an opt-out approach for use of personal data rather than an opt-in approach.
• After an opt-out, businesses must avoid requesting opt-in consent for 12 months.
• CCPA applies when annual gross revenues exceed US$25 million, or when more than 50,000 records of consumers, households, or devices are possessed, or when more than half of annual revenue comes from selling consumers’ personal data.
• CCPA fines can reach up to US$7,500 per record for intentional violations and up to US$2,500 per record for unintentional violations.
• GDPR maximum penalties are up to €20 million or 4% of annual gross revenue of the group, whichever is higher.
• CCPA provides a right for victims to file class action lawsuits seeking statutory damages between US$100 and US$750 per individual, or greater actual damages.
• CCPA includes rights to know whether personal data is sold or disclosed and specifically to whom it is sold or disclosed.
• CCPA requires that individuals not be discriminated against for exercising privacy rights.

Notable Quotes

• “With CCPA becoming effective on January 1st, 2020, businesses must act now”
• “CCPA, like GDPR, has an extra-territorial scope and is relevant not only to businesses that are resident in California but also to those doing business within California and with California residents.”
• “Discovery is where everything starts. If you don’t know where personal data resides, you can’t protect if efficiently.”
• “Regulatory compliance with data protection regulations such as CCPA will not be achieved by deploying a single technology, but by having a well-thought-out portfolio of technologies in place, covering all types of data and requirements.”
• “Technologies for data encryption, data tokenization, and data masking are essential elements of every well thought-out approach to cybersecurity and regulatory compliance.”
• “The practical impact of data tokenization and masking is that uncontrolled data sprawl will be limited, because users must request data access and de-tokenization, thus becoming subject to solid security controls.”
• “Complying with CCPA requires technology, but it is not a technology-first topic.”
• “Accountability and responsibility do not transfer but duplicate when the data leaves the organization.”
• “The less access someone can gain to personal data, the lower the risk involved in data breaches and fraudulent use, and the lower the potential consequences of such incidents.”
• “Data-centric security is essential for a successful CCPA strategy.”