CCPA and GDPR Comparison Chart - bakerlaw.com

1 Resource ID: w-016-7418. CCPA and GDPR Comparison Chart LAURA JEHL AND ALAN FRIEL, BAKERHOSTETLER LLP, WITH PRACTICAL LAW DATA PRIVACY ADVISOR. Search the Resource ID numbers in blue on Westlaw for more. A Chart comparing some of the key The CCPA grants California resident's new rights regarding their personal information and imposes various data protection duties requirements of the California Consumer Privacy on certain entities conducting business in California. While it Act (CCPA) and the EU General Data Protection incorporates several GDPR concepts, such as the rights of access, portability, and data deletion, there are several areas where the Regulation (GDPR).

2 CCPA requirements are more specific than those of the GDPR or where the GDPR goes beyond the CCPA requirements. The EU General Data Protection Regulation (Regulation (EU) This Chart provides a high-level Comparison of key requirements 2016/679) (GDPR) took effect on May 25, 2018 and replaced the under the CCPA and the GDPR. It is not a comprehensive list of all EU Directive and its member state implementing laws. On June 28, measures required under the CCPA or the GDPR. 2018, California became the first state with a comprehensive For an overview of the CCPA, see Practice Note, California Privacy consumer privacy law when it enacted the California Consumer and Data Security Law: Overview: General Data Protection and the Privacy Act of 2018 (CCPA), which becomes effective January 1, California Consumer Privacy Act (6-597-4106) and Article, Expert Q&A: 2020, with some exceptions (Cal.)

3 Civ. Code ). The California Consumer Privacy Act of 2018 (CCPA) (W-015-6908). Given their comprehensiveness and broad reaches, each law may have significant impact on entities that collect and process For an overview of the GDPR, see Practice Note, Overview of EU. personal data. General Data Protection Regulation (W-007-9580). Practical Law Resources CCPA GDPR Comparison and Citations Who is Regulated? Any for-profit entity doing business Data controllers and data The scope and territorial CCPA. in California, that meets one of the processors: reach of the GDPR is following: much broader.

4 Cal. Civ. Code (c). Established in the EU. Has a gross revenue greater than that process personal Boxes, CCPA Definitions Substantially different in $25 million. data in the context parties regulated. and CCPA Exceptions to Annually buys, receives, sells, or of activities of the Extraterritorial Applications. shares the personal information EU establishment, regardless of whether Practice Note, California of more than 50,000 consumers, the data processing Privacy and Data Security households, or devices for takes place within Law: Overview: CCPA Scope commercial purposes.

5 The EU. (6-597-4106). Derives 50 percent or more of its annual revenues from selling Not established in the GDPR. consumers' personal information. EU that process EU. data subjects' personal Article 3. The law also applies to any entity that data in connection Practice Note, Determining either: with offering goods the Applicability of the Controls or is controlled by a covered or services in the EU, GDPR (W-003-8899). business. or monitoring their behavior. Shares common branding with a covered business, such as a shared name, service mark, or trademark.

6 2018 Thomson Reuters. All rights reserved. CCPA and GDPR Comparison Chart Practical Law Resources CCPA GDPR Comparison and Citations Parts of the CCPA apply specifically to: Service providers. Third parties. Who is Protected? Consumers, defined as California Data subjects, defined as Substantially different in CCPA. residents that are either: identified or identifiable approach, but similarly persons to which personal broad in effect. Cal. Civ. Code (g). In California for other than a data relates. and Cal. Code Regs. tit.

7 18, temporary or transitory purpose. Both laws focus on 17014. Domiciled in California but are information that relates currently outside the State for a to an identifiable natural Practice Note, California temporary or transitory purpose. person, however the Privacy and Data Security definitions differ. Law: Overview: CCPA Scope Consumers include: (6-597-4106). Customers of household goods and Both have potential extraterritorial effects GDPR. services. that businesses located Article 4(1). Employees. outside the jurisdiction Business-to-Business transactions.

8 Must consider. Practice Note, Overview of EU General Data Protection Regulation: Identifiability (W-007-9580). What Information is Personal information that identifies, Personal data is any Substantially similar. CCPA. Protected? relates to, describes, is capable of being information relating to an However, the CCPA. associated with, or may reasonably identified or identifiable definition also includes Cal. Civ. Code (o). be linked, directly or indirectly, with a data subject. information linked at the and (c)-(f). particular consumer or household.

9 Household or device level. Boxes, Categories of Personal The GDPR prohibits The statutory definition includes a processing of defined Information Under the CCPA. list of specific categories of personal special categories of and Information Excluded information. personal data unless a From the CCPA's Personal lawful justification for Information Definition. Personal information does not include processing applies. certain publicly available government Practice Note, California records. The CCPA also excludes certain Privacy and Data Security personal information covered by other Law: Overview: Personal sector specific legislation from its Information under CCPA.

10 Coverage scope. (6-597-4106). GDPR. Articles 4(1) and 9(1). Practice Note, Overview of EU General Data Protection Regulation: Personal Data and Data Subjects (W-007-9580). and Special Categories of Personal Data (W-007-9580). Anonymous, The CCPA does not restrict a business's Pseudonymous data is The CCPA and GDPR CCPA. Deidentified, ability to collect, use, retain, sell, or considered personal data. pseudonymization Pseudonymous, or disclose a consumer information that is definitions are very similar Cal. Civ. Code (a), Aggregated Data deidentified or aggregated.