Comparing privacy laws: GDPR vs. CCPA
Reference:https://fpf.org/wp-content/uploads/2018/11/GDPR_CCPA_Comparison-Guide.pdf
General Data Protection Regulation (GDPR) Effected date: 25 May 2018
California Consumer Privacy Act (CCPA) Effected date: 1 January 2020
(Can be sooner due to certain provisions requires organizations to provide consumers with information regarding the preceding 12-month period.)
Both aim to guarantee strong protection for individuals regarding their personal data and apply to businesses that collect, use, or share consumer data, whether the information was obtained online or offline.
Both have additional protections for individuals under 16 years of age.
Difference:
- A fundamental principle of the GDPR is the requirement to have a “legal basis” for all processing of personal data.
That is not the case for the CCPA. - Scope of application.
- The nature and extent of collection limitations.
- Rules concerning accountability.
- CCPA excludes from its scope the processing of some categories of personal information altogether, such as medical data covered by other U.S. legal frameworks, including processing of personal information for clinical trials, and personal information processed by credit reporting agencies.
- The CCPA focuses on transparency obligations and on provisions that limit selling of personal information, requiring a “Do Not Sell My Personal Information” link to be included by businesses on their homepage.
- The CCPA includes specific provisions in relation to data transferred as a consequence of mergers and acquisitions, providing consumers with the right to op-out if the “third party materially alters how it uses or shares the personal information of a consumer in a manner that is materially inconsistent with the promises made at the time of collection.”
