How Does The CCPA Compare To The GDPR?

Uploaded on 2020-03-25 in FREE TO VIEW, BUSINESS-Services-Law

On May 25, 2018, the General Data Protection Regulation (GDPR) came into effect - marking one of the most critical digital developments of the century. The legislation originated in the European Union (EU), and effectively protects the data rights of European Economic Area (EEA) residents. However, companies around the world that target users in the EEA are subject to comply with the hefty legislation.

While the effects of the GDPR itself have been felt these past two years, one of the most notable changes it has brought to the digital space is an influx in copycat legislation, and a call for similar protections to users’ data around the globe. 

Among the laws, regulations, and guidelines that have followed in the footsteps of the GDPR is the California Consumer Privacy Act (CCPA). As its name implies, this law comes from California, and serves to protect Golden State residents whose data is collected and shared by companies all over the world. 

How Are the CCPA and GDPR Similar? 

The CCPA is based on the GDPR, although it is notably lighter in size and scope. Both laws seek to protect the rights of individuals over their personal information by establishing data-handling best practices for businesses, and new data rights for users.

Among the shared features of the laws is the emphasis on accountability.  Both pieces of legislation threaten hefty fines for companies who fail to protect the data they collect from individuals and establish minimum expectations of data security. 

For example, both the GDPR and the CCPA emphasize the need for companies to implement Privacy by Design (PbD). PbD is the idea that privacy measures and data protection is built into the very framework of a business, website, or app. 

Given the potential consequences for failing to take data privacy seriously - millions of dollars in fines - both laws are setting new standards for data safety. 

How Are the Laws Different? 

While the CCPA is sometimes referred to as the California GDPR, these laws are far from the same. The GDPR is notably stricter, broader in scope, and ladened with far fewer loopholes than the CCPA. 

For example, the CCPA sets thresholds to determine what companies are subject to comply. These thresholds include annual revenue, revenue generated by data sale, and how many consumers’ data is collected. 

The GDPR, on the other hand, is applicable to any business that targets users in the EEA — regardless of company size, location, or revenue. In effect, a small travel blog in Idaho that sends newsletters to a few people in Switzerland is subject to comply with the GDPR. They would not, on the other hand, likely need to comply with the CCPA. 

Another key distinction between the two laws is the extent of their guidelines. The GDPR lays out extensive guidelines and boundaries for proper data handling, while the CCPA sets remarkably fewer strictures. 

Of the most significant requirements the GDPR establishes is the right for users to opt in to data collection. This guideline revolves around the notion that if businesses aren’t collecting data on a legal basis such as legitimate interests or to fulfill a contract, they should be basing that data collection on user consent. Therefore, businesses need to ask for users to opt in to the collection of their data. 

Alternatively, the CCPA has no such guidelines, and only sets a requirement for businesses to allow users to opt out of the sale of their personal information. 

What Does It All Mean for Businesses? 

Not only are thousands of businesses around the world subject to comply with one or both of these landmark privacy laws, but the GDPR and CCPA are only the beginning of a new wave of digital legislation. 

With over a hundred countries implementing or working to implement similar laws, the CCPA and GDPR are the foundation of the new standards for data privacy and protection. 

If you own or operate a website, app, or business that relies on consumer data, you need to understand these laws and the goals they seek to achieve.

To learn more about the key similarities and differences between the GDPR and CCPA, check out this infographic from Termly below:

You Might Also Read: 

GDPR's Impact In The US And Globally:

 

 

« Take Action On Cyber Security Training
AI Can Give An Early Warning Of Coronavirus »

CyberSecurity Jobsite
Perimeter 81
Cyrin

Real Attacks. Real Tools. Real Scenarios.
Schedule a demo

Go Cyber

Training that transforms behaviours

Sign Up: Cyber Security Intelligence Newsletter

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Veeam

Veeam

Veeam is the leader in intelligent data management for the Hyper-Available Enterprise.

HireVergence

HireVergence

HireVergence is a full service IT staffing and recruiting firm with a focus on cyber and information security.

Maryman & Associates

Maryman & Associates

Maryman & Associates are specialists in computer forensic investigations, incident response and e-discovery services.

National Cyber-Forensics & Training Alliance (NCFTA) - USA

National Cyber-Forensics & Training Alliance (NCFTA) - USA

NCFTA is a trusted alliance of private industry and law enforcement partners dedicated to information sharing and disrupting cyber-related threats.

Sensible Vision

Sensible Vision

SensibleVision helps organizations transparently protect data and prevent costly security breaches by constantly verifying the identities of people who use computers or mobile devices.

Hexatrust

Hexatrust

The HEXATRUST club was founded by a group of French SMEs that are complementary players with expertise in information security systems, cybersecurity, cloud confidence and digital trust.

Optra Security

Optra Security

Optra Security specializes in information security with a focus on Application Security.

Sergeant Laboratories

Sergeant Laboratories

Sergeant Laboratories builds advanced technologies to prove compliance in complex IT security and regulatory compliance situations.

Intraprise Health

Intraprise Health

Intraprise Health is a Certified HITRUST Assessor and award-winning provider of health information security products and services.

FPT Software

FPT Software

As a leading technology service provider, FPT assists customers of all sizes and from any industries in implementing and adapting digital technologies including cybersecurity.

Valence Security

Valence Security

Valence manages and secures your Business Application Mesh by delivering visibility, reducing unauthorized access and preventing data loss.

Synoptek

Synoptek

Synoptek is a global systems integrator and managed IT services provider (MSP). We offer comprehensive IT management and consultancy services to organizations worldwide.

Sycope

Sycope

Sycope is focused on designing and developing highly specialised IT solutions for monitoring and improving network and application performance.

Confidencial

Confidencial

Confidencial is a provider of solutions that help organizations secure their most sensitive information, regardless if that information exists inside or is shared outside the organization.

TerraEagle

TerraEagle

Terraeagle is a boutique cyber security services company providing tailor-made solutions. Our core competency is in SOCaaS, MDRaaS & and Incident Response Retainer Services.

Veracity Trust Network

Veracity Trust Network

Veracity Trust Network safeguards organisations from the threat of bot attacks on their public facing platforms.