How Does The CCPA Compare To The GDPR?

Uploaded on 2020-03-25 in FREE TO VIEW, BUSINESS-Services-Law

On May 25, 2018, the General Data Protection Regulation (GDPR) came into effect - marking one of the most critical digital developments of the century. The legislation originated in the European Union (EU), and effectively protects the data rights of European Economic Area (EEA) residents. However, companies around the world that target users in the EEA are subject to comply with the hefty legislation.

While the effects of the GDPR itself have been felt these past two years, one of the most notable changes it has brought to the digital space is an influx in copycat legislation, and a call for similar protections to users’ data around the globe. 

Among the laws, regulations, and guidelines that have followed in the footsteps of the GDPR is the California Consumer Privacy Act (CCPA). As its name implies, this law comes from California, and serves to protect Golden State residents whose data is collected and shared by companies all over the world. 

How Are the CCPA and GDPR Similar? 

The CCPA is based on the GDPR, although it is notably lighter in size and scope. Both laws seek to protect the rights of individuals over their personal information by establishing data-handling best practices for businesses, and new data rights for users.

Among the shared features of the laws is the emphasis on accountability.  Both pieces of legislation threaten hefty fines for companies who fail to protect the data they collect from individuals and establish minimum expectations of data security. 

For example, both the GDPR and the CCPA emphasize the need for companies to implement Privacy by Design (PbD). PbD is the idea that privacy measures and data protection is built into the very framework of a business, website, or app. 

Given the potential consequences for failing to take data privacy seriously - millions of dollars in fines - both laws are setting new standards for data safety. 

How Are the Laws Different? 

While the CCPA is sometimes referred to as the California GDPR, these laws are far from the same. The GDPR is notably stricter, broader in scope, and ladened with far fewer loopholes than the CCPA. 

For example, the CCPA sets thresholds to determine what companies are subject to comply. These thresholds include annual revenue, revenue generated by data sale, and how many consumers’ data is collected. 

The GDPR, on the other hand, is applicable to any business that targets users in the EEA — regardless of company size, location, or revenue. In effect, a small travel blog in Idaho that sends newsletters to a few people in Switzerland is subject to comply with the GDPR. They would not, on the other hand, likely need to comply with the CCPA. 

Another key distinction between the two laws is the extent of their guidelines. The GDPR lays out extensive guidelines and boundaries for proper data handling, while the CCPA sets remarkably fewer strictures. 

Of the most significant requirements the GDPR establishes is the right for users to opt in to data collection. This guideline revolves around the notion that if businesses aren’t collecting data on a legal basis such as legitimate interests or to fulfill a contract, they should be basing that data collection on user consent. Therefore, businesses need to ask for users to opt in to the collection of their data. 

Alternatively, the CCPA has no such guidelines, and only sets a requirement for businesses to allow users to opt out of the sale of their personal information. 

What Does It All Mean for Businesses? 

Not only are thousands of businesses around the world subject to comply with one or both of these landmark privacy laws, but the GDPR and CCPA are only the beginning of a new wave of digital legislation. 

With over a hundred countries implementing or working to implement similar laws, the CCPA and GDPR are the foundation of the new standards for data privacy and protection. 

If you own or operate a website, app, or business that relies on consumer data, you need to understand these laws and the goals they seek to achieve.

To learn more about the key similarities and differences between the GDPR and CCPA, check out this infographic from Termly below:

You Might Also Read: 

GDPR's Impact In The US And Globally:

 

 

« Take Action On Cyber Security Training
AI Can Give An Early Warning Of Coronavirus »

CyberSecurity Jobsite
Perimeter 81
Cyrin

Real Attacks. Real Tools. Real Scenarios.
Schedule a demo

Sign Up: Cyber Security Intelligence Newsletter

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

AppSec Labs

AppSec Labs

AppSec Labs specialise in application security. Our mission is to raise awareness in the software development world to the importance of integrating software security across the development lifecycle.

macmon secure

macmon secure

macmon secure develops network security software, focussing on Network Access Control.

Assac Networks

Assac Networks

Assac Networks ShieldIT is an app that completely protects any BYOD smartphone from both tapping and hacking.

DAkkS

DAkkS

DAkkS is the national accreditation body for Germany. The directory of members provides details of organisations offering certification services for ISO 27001.

SYSGO

SYSGO

SYSGO is the leading European provider of real-time operating systems for critical embedded applications in the Internet of Things (IoT).

CyberGuru

CyberGuru

CyberGuru is a service provided by CyberSecurity Malaysia specializing in cyber security professional training and development.

Security Innovation Network (SINET)

Security Innovation Network (SINET)

SINET is dedicated to building a cohesive, worldwide Cybersecurity community with the goal of accelerating innovation through collaboration.

Crypsis

Crypsis

Crypsis was built based on a shared vision of creating a more secure digital world by providing the highest quality incident response, risk management, and digital forensic services.

Raonsecure

Raonsecure

Raonsecure is one of Korea’s leading ICT security software companies – providing a variety of PC and mobile security solutions to financial institutions, government, and enterprise.

Russell Reynolds Associates

Russell Reynolds Associates

Russell Reynolds Associates is a global leadership advisory and search firm with functional expertise in Digital Leadership, Data & Analytics, and Compliance.

Aware

Aware

Aware is the only comprehensive AI solution for governance, risk, compliance and insights for leading collaboration platforms.

Canonic Security

Canonic Security

Canonic streamlines app review, continuously monitors apps, and reduces the risks involved in third-party access to your data.

CyberSecureRIA

CyberSecureRIA

We founded CyberSecureRIA specifically to secure and support RIAs. We exist to secure SEC-registered RIAs, and keep them compliant with cybersecurity regulations.

MiDO Technologies

MiDO Technologies

MiDO Technologies has a mission to change the narrative around digital enabling tools on the continent of Africa and prepare African youth.

Disecto Technologies

Disecto Technologies

At Disecto, we provide SaaS based Data Discovery, Classification and a remediation solution for data privacy compliance.

Hiya

Hiya

Hiya's mission is to secure voice with trust, identity and intelligence. We're protecting people from spam and fraud calls, and helping carriers secure their networks for all.