What is GDPR and CCPA Compliance?

Personal data protection has managed to push itself to the forefront of how we do business, deliver information, and collect useful particulars of the people we do—and would like to do—business with.

With the rise of the Internet and its fast-paced growth, our information is more accessible than ever. Handing over names, addresses, and bank details are all definite candidates for protection. Yet, recently the CCPA and GDPR legislation has been compacted to protect us against any personal data breach, whether we’re visiting websites or physical businesses.

We’re here to look into what that personal data is, the difference between GDPR vs CCPA collections, the deadlines for data provision and removal, and of course, how our PrivacyRun tool will help keep you ahead of the curve at all times.

First, though, for anyone not in the know, what is GDPR and CCPA? Well, they’re the legislative acts that define how consumer data is monitored and regulated. The acronyms stand for General Data Protection Regulation and California Consumer Privacy Act.

GDPR is European legislation, and one of the most in-depth measures to control data throughout the world. It’s become the standard for the rest of the world to follow.

What about the CCPA? Why only California consumers? In the absence of an overall US law or regulation to contain data use, selling, and privacy in the States, the CCPA is the best they’ve got.

What are the GDPR and CCPA data rights?

Both organizations provide the data subject with similar rights, yet we’d be remiss if we didn’t outline the CCPA and GDPR differences.

The basic CCPA vs GDPR data rights are shown below.

• Rights to erasure (right to deletion)
• Right to be informed
• Right to object (right to opt-out)
• Right of access
• Right not to be subject to discrimination for the exercise of rights
• Right to data portability

So, how is CCPA different than GDPR when it comes to each of these rights? We’ll look at each one in a little detail to expand on what they mean.

Right to erasure

A consumer or data subject has the right to deletion unless in very specific circumstances. From the CCPA, the data needs to have been collected from the consumer to apply.

Exceptions from both legislations include freedom of speech, processing of personal data for research purposes, legal claims, and when complying with a legal obligation.

Right to be informed

The consumer or data subject also has the right to be informed at the point where their data is collected and processed. The information must include the categories of data, the purpose of its processing and the rights of the consumer. The CCPA demands that the ‘Do Not Sell My Personal Information Page’ link is included on any inclusion where the business intends to sell or transmit the data to a third party.

Right to object

All consumers and data subjects have the right to opt-out of such data processing or selling. The CCPA, again, demands the inclusion of the ‘Do Not Sell My Personal Information’ link. The GDPR stipulates that there should be several ways to opt-out of processing, by withdrawing consent or exercising their right to object.

Right of access

Another stipulation is the access and full visibility of the data that’s collected about each individual. Where access is granted, the information must be available to be transmitted back to the individual electronically, in a portable and useable format.

This pocket of information includes:

• The purpose of collection
• The categories of data
• The recipients or categories of recipients
• And any sources from where the data was collected

The CCPA also specifies consumers have the right to the categories of third parties their data has been shared with.

Right not to be subject to discrimination for the exercise of rights

This is a hard and fast rule of the CCPA, whereas, with the GDPR, it’s not exclusive. Yes, you can find provisions in several areas of GDPR that amount to a similar thing, more along the lines of discriminatory consequences derived from the processing of their data.

The CCPA, with its definite scope, protects the use of consumer data to prevent being denied goods or services. It also prevents consumers from being charged different prices or rates for goods and services, provided a different level of quality for the same, or even to have it suggested that they’d receive different prices and rates.

Right to data portability

Both laws offer fairly consistent rules and values about portability. The CCPA sees it as a right to access, while the GDPR considers it a separate and distinctive right.

What they do agree on is that data subjects and consumers have a right to a structured, easily transmitted, and machine-readable format of their data. Applications require replies in specific timeframes, of which we’re about to detail.

Compare GDPR and CCPA notice periods and active timescales

Right to erasure, right to data portability—notice periods and timescales

Both legislations allow the deletion of individuals’ data apart from where specific exceptions apply. The deletion applies to any data collected from the consumer. The rights are very similar, only the timescales and a few other specifics differ.

GDPR versus CCPA timeframes:

GDPR – Requests for removal must be replied to within 1 month of the data subject’s request. This deadline can be extended a further 2 months in complex cases with large numbers of requests. However, the deadline must be outlined in the initial reply.

CCPA – Requests for removal must be replied to within 45 days of the consumer’s request. This deadline can be extended a further 45 days when reasonably necessary. Again, the extension must be outlined in the initial reply.

How PrivacyRun manages GDPR and CCPA compliance to keep you within the boundaries of legislation

PrivacyRun is the perfect solution to these CCPA GDPR problems. It’s fully compliant and built to make sure your business avoids missing deadlines—then becoming subject to the hefty penalties and fines.

It’s a personal data administrator’s optimum tool to monitor deadlines, responses, requests, and more.

The system dashboard delivers everything you’ll need in an easy to understand and digest presentation. It’s not just numbers and lists—it’s a clean and clear depiction of your process, including when and how your consumer requests are getting processed.

You’ll find neatly delivered graphs, sectioned and detailed with everything you need. PrivacyRun ecompasses consent management, data subject rights automation, personal data inventory and data mapping, all incidents of personal data breaches, and DPIA risk analysis. It covers both EU and US issues, and everywhere around the world where your data may arrive from or end up.

If you run several companies, we’ve got that covered too. Our compliance solution tool manages each organization independently, making sure you monitor and maintain your best practices, avoiding any failures in your data protection government.

Given the penalties of failing to adhere to regulations, can you afford not to have such a system in place?

And that brings us on to the CCPA GDPR differences in enforcement.

Enforcement of broken GDPR CCPA legislation

When it comes to enforcement, it’s not an area to be taken lightly. Those who fail to comply with the laws are at the hands of the US Attorney General and the National Data Protection Authorities.

Both authorities have different investigatory and enforcement powers, yet the fines are considerable, and avoidable with suitable best practices in place.

The difference between GDPR and CCPA fines are as follows:

The GDPR penalties for non-compliance can be up to 2% of the business annual turnover or €10 million, whichever is higher—or 4% of the global annual turnover or €20 million, whichever is higher.

The different fine rates depend on the violation under investigation.

The CCPA delivers civil penalties issued by a court, and, again, depending on the violation, you may be fined $2,500 for each accidental violation or $7,500 for each intentional violation.

There is no maximum amount set by the CCPA for the imposition of several penalties for each violation.

Damages for individuals pursuing privacy violations

As if the penalties outlined above weren’t trouble enough, both bodies provide data subjects and consumers with the right to seek damages.

How is CCPA different from GDPR when it comes to costing violations? The GDPR allows action to be taken against any violation of the law, where the CCPA only provides cause for failure of security measures in context of data breaches.

The GDPR doesn’t outline potential figures for damages, that will be left to the adjudicating bodies.

The CCPA ruling only permits that non-encrypted and non-redacted personal information is subject to unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of security obligations.

The damages in such circumstances are to be no less than $100 or greater that $750 per consumer per incident, or a cost covered by actual damages—whichever is greater.

Conclusion

Looking into how GDPR vs CCPA chart their differences across their legislation, it’s easy to see plenty of similarities—but the overriding fact is that if you break the rules, you’ll pay for it.

Whether that’s missing deadlines for communication, selling data you shouldn’t, or failing to implement the correct information on your data collection points—they all add up to the same thing—costly penalties that you could have avoided.

PrivacyRun can help prevent all of that. It’s there to make sure you’ve got the systems to manage every piece of data and information within the remits of the law and the structures that govern them. If you don’t want to be caught short, then we suggest you speak to one of our team as soon as possible.

We put our all into everything we do. Because of that, we guarantee that our solutions are built to protect you—now, and far into the future.