How the CCPA Impacts the Auto Industry
Auto dealers, auto lenders and consumers need to understand the legal consequences for failing to comply with the California Consumer Privacy Act (CCPA)..
The law, which went into effect in January, has forever changed the landscape of privacy laws in the United States.
Why You Will Need to Comply with the CCPA
The CCPA protects the privacy rights of California consumers and affects businesses that operate within the state and outside of the state. Auto companies that operate dealerships, or who service customers who reside in California, or who do business in California, are required to comply. If you meet ONLY 1 of the three thresholds below, you will be required to comply:
1. Earn more than $25 million in annual revenue
2. Profit from the personal information of more than 50,000 people/households/devices
3. Get at least 50% of their revenue from the selling of this information
There are certain auto industry exemptions, which are summarized below:
• Warranty repairs and recalls. This includes vehicle information and ownership, shared between a dealer and manufacturer regarding warranties and recalls.
• Credit reports. This is any activity involved in the collection, maintenance, disclosure, sale, communication or use of any personal information in determining a consumer’s credit qualifications.
• Vehicle record information. This is the personal information derived from motor vehicle records that is collected, processed, sold or disclosed pursuant to the federal Driver’s Privacy Protection Act.
• Financial Information. Personally identifiable financial information that is collected, processed, sold or disclosed pursuant to the federal Gramm-Leach-Bliley Act or the California Information Privacy Act.
If your business is not subject to these exemptions, it will be required to comply with the CCPA..
Auto dealers will also be required to respond to consumer requests about information collection and use, as well as sale opt-outs.
These requests include:
• The right to know when information is collected
• How this information will be used and if it will be sold
• The right to a portable file format of the specific information collected and maintained
• The right to be forgotten through deletion of personal information
• The right to opt out when information is sold
More Changes to Come
The CCPA has generated many changes and it was the first privacy law of its kind. There are more initiatives on the ballot, including CCPA 2.0.. This is intended to provide additional rights and an agency dedicated to consumer privacy rights.
Other states are working on enacting new privacy laws of their own, including Virginia and Washington. Connecticut, Hawaii, Louisiana, Texas and North Dakota have established their own task forces related to data privacy.
Auto companies are encouraged to carefully monitor these developments and the impact these new laws could have on data privacy management.