{"id":1865,"date":"2018-12-06T15:46:08","date_gmt":"2018-12-06T13:46:08","guid":{"rendered":"https:\/\/www.endpointprotector.com\/blog\/?p=1865"},"modified":"2020-12-08T11:23:40","modified_gmt":"2020-12-08T08:23:40","slug":"ccpa-vs-gdpr-comparison","status":"publish","type":"post","link":"https:\/\/www.endpointprotector.com\/blog\/ccpa-vs-gdpr-comparison\/","title":{"rendered":"CCPA vs. GDPR: How the Two Data Protection Regulations Compare"},"content":{"rendered":"

The California Consumer Privacy Act (CCPA)<\/a> is the most significant development in privacy legislation in the US in recent years.\u00a0 Hurriedly passed into law on 28 June 2018, the CCPA followed in the footsteps of the EU\u2019s General Data Protection Regulation<\/a> (GDPR), which was enforced only a month prior. It aims to protect consumers\u2019 privacy by establishing new data protection<\/a> standards and granting consumers rights over their data.<\/p>\n

Given it was inspired by the GDPR, the CCPA shares many similarities with its European counterpart. Among others, data subjects\u2019 right to know what data is being collected about them and how it is being used as well as the right to have their data erased. That being said, the CCPA is adapted to its US context and differs in significant ways from the GDPR, especially in regards to its scope and accountability. Here are some of the key differences to keep in mind:<\/p>\n

EU Data Subjects vs. California Residents<\/strong><\/h2>\n

While neither the GDPR nor the CCPA apply to legal persons, both apply to natural persons, but with a difference in the way they are defined. The CCPA clearly states that it applies to California residents, while the GDPR uses the more vague term \u201cEU data subjects\u201d without naming any residency or citizenship requirements. The CCPA also protects data that can be linked to a particular household, not just an individual as the GDPR does.<\/p>\n

All Organizations vs. For-Profit Companies<\/strong><\/h2>\n

The GDPR\u2019s scope is broad: it applies to all organizations, from businesses to public institutions and the non-profit sector. The CCPA meanwhile has restricted its applicability to for-profit companies that meet very clear requirements: they must have an annual gross revenue of over $25 million, buy, receive for commercial purposes, sell, or share for commercial purposes, the personal information of 50,000 or more consumers and derive 50 percent or more of their annual revenue from selling consumers\u2019 personal information.<\/p>\n

In regards to geographical location, the GDPR applies to any company that processes the data of EU data subjects, wherever they may be located. The CCPA is unclear on this point: companies falling under its jurisdiction must be \u201cdoing business in California\u201d, but does not clarify whether the company must be located in the state or meet certain profit thresholds to qualify as such.<\/p>\n

All Personal Data vs. Particular Categories<\/strong><\/h2>\n

The GDPR applies to all categories of personal data, while the CCPA, as of September 2018, only applies to data not covered by existing federal privacy laws such as the Gramm-Leach-Bliley Act (GLBA) or the Health Information Portability and Accountability Act (HIPAA).<\/p>\n

Data disclosures<\/strong><\/h2>\n

Both the GDPR and the CCPA require organizations to disclose what they do with the personal data they collect. The CCPA however requires companies to disclose data sales and activities pertaining to data processing in the last 12 months, while the GDPR places no such limitation.<\/p>\n

Consumers\u2019 rights<\/strong><\/h2>\n

While the GDPR requires organizations to get prior consent from data subjects for data processing and third-party access to their data, the CCPA allows data subjects to opt-out of the sale of their data and requires businesses to have a visible link at the top of their homepage for this purpose.<\/p>\n

Both the GDPR and the CCPA offer the right to data portability: namely to provide consumers with their personal data in a commonly used, machine-readable format that can then be transmitted to another entity. The GDPR goes a step further in this direction, putting organizations under the obligation to transfer a data subject\u2019s information to another data controller upon request. Under the CCPA, businesses are only required to provide consumers with the information electronically in a readily useable format.<\/p>\n

While the GDPR\u2019s right to erasure<\/a> has a few notable exceptions such as data necessary for exercising the right of freedom of expression or data needed for compliance with EU or EU member state law, the CCPA broadens these exceptions further by including not only free speech and information needed for contracts, but, most notably, also internal uses compatible with the context in which the consumer provided the data.<\/p>\n

In Conclusion<\/strong><\/h2>\n

While in many ways the GDPR and the CCPA align, there are notable differences between the two regulations. The GDPR\u2019s definitions are often broader, while the CCPA has taken a more specific approach to its scope. That does not mean however that companies that are GDPR compliant don\u2019t need to worry about the CCPA. As shown above, the CCPA\u2019s requirements sometimes fall beyond the GDPR\u2019s reach. It is important therefore that companies consult both regulations and look for the appropriate tools<\/a> to help them on their road to compliance.<\/p>\n","protected":false},"excerpt":{"rendered":"

The California Consumer Privacy Act (CCPA) is the most significant development in privacy legislation in the US in recent years.\u00a0 Hurriedly passed into law on 28 June 2018, the CCPA followed in the footsteps of the EU\u2019s General Data Protection Regulation (GDPR), which was enforced only a month prior. It aims to protect consumers\u2019 privacy … <\/p>\n

Continue reading “CCPA vs. GDPR: How the Two Data Protection Regulations Compare”<\/span><\/a><\/p>\n","protected":false},"author":9,"featured_media":1866,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[115],"tags":[],"class_list":["post-1865","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-compliance","entry"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts\/1865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/comments?post=1865"}],"version-history":[{"count":9,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts\/1865\/revisions"}],"predecessor-version":[{"id":3621,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/posts\/1865\/revisions\/3621"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/media\/1866"}],"wp:attachment":[{"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/media?parent=1865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/categories?post=1865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.endpointprotector.com\/blog\/wp-json\/wp\/v2\/tags?post=1865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}