California passed sweeping privacy legislation in June 2018 calling for the strongest privacy measures of any state in the US, similar to the Global Data Protection Regulation (GDPR) in Europe.
Even though companies have had over a year to get ready for the January 2020 deadline, it is clear that many, if not most, are woefully unprepared.
However, there’s a problem: According to a survey released by PossibleNOW, which sells enterprise privacy management solutions, over half of US businesses say they don’t expect to be fully prepared by the time CCPA takes effect on New Year’s Day 2020.
Respondents provided several reasons for not being ready, including:
35 per cent said their primary reason is the cost of becoming compliant.
32 per cent stated they were waiting to see how the CCPA will be enforced.
17 per cent said they didn’t think their organization is large enough to face fines.
11 per cent said the law is new to them and they are unsure of the requirements.
4 per cent stated they didn’t think the law applies to them (in truth, some smaller companies are exempt from CCPA).
According to PossibleNOW, the penalties for laggards could be stiff: for example, a company that is found in non-compliance related to 1,000 customers could face penalties ranging from $2.5 million to $7.5 million. And for the largest companies which rely heavily on user data – think the GAFA group (Google, Amazon, Facebook, Apple), it’s easy to envisage those costs going much higher than that.
The California governor’s office, which ultimately will be responsible for enforcing the new law, has not revealed yet whether it intends to offer lagging companies any additional time to comply with the regulation once 2020 rolls around. But relief or no relief, it is clear that companies will need to get on board soon if they want to continue to thrive in a state whose $3tn economy would rank as the fifth largest country in the world, larger than the UK, France or India.