Applicability of the California Consumer Privacy Act (CCPA) and Related Laws in USA - California

California has established a data protection framework that governs the handling of personal information within the state. The primary role of this framework is fulfilled by the California Consumer Privacy Act of 2018, which regulates the collection, use, and disclosure of personal information by businesses.

The California Consumer Privacy Act of 2018 was adopted on June 28, 2018 and became effective on January 1, 2020. The most recent amendment to the act is Stats. 2024, Ch. 121, Sec. 14 adopted on August 21, 2024 and effective on January 1, 2025. California maintains various legal frameworks governing the protection of personal information across different sectors and contexts. Within this broader data protection landscape, the California Vehicle Code Section 1808.21 (Confidentiality of Addresses in Department Records) serves as a specific provision addressing the confidentiality of address information maintained in department records.

The California Vehicle Code was adopted on January 1, 1995 and became effective on the same date of January 1, 1995.

The most recent amendments to the act were introduced through the Amendment to California Vehicle Code (Stats. 2003, Ch. 720, Sec. 1), which was adopted on January 1, 2004 and became effective on January 1, 2004. This amending act represents the latest legislative updates to the original California Vehicle Code. California's data protection framework includes various legislative measures addressing different aspects of information privacy and security. Within this framework, the California Civil Code, Division 1 - Persons, Part 2.6 - Confidentiality of Medical Information serves as the primary legislation governing the confidentiality of medical information in the state.

The California Civil Code, Division 1 - Persons, Part 2.6 - Confidentiality of Medical Information was adopted on January 1, 1981, and became effective on January 1, 1982. The most recent amendments to the act were introduced through Assembly Bill No. 254 (AB 254), which was adopted on September 27, 2023, and became effective on January 1, 2024.

Territorial Scope

The CCPA applies to businesses operating in California with key provisions defining territorial scope:

Section 1798.145(a)(7) establishes that the law does not apply when:

• All aspects of commercial conduct take place wholly outside California
• Information was collected while consumer was outside California
• No part of personal information sale occurred in California
• No personal information collected in California is sold

Material Scope

Business Thresholds

Per Section 1798.140(d), the CCPA applies to businesses that:

1. Are for-profit entities
2. Collect consumers' personal information
3. Determine purposes and means of processing
4. Do business in California
5. Meet one or more of these thresholds:
   • Annual gross revenue exceeding $25 million
   • Annually buys/sells/shares personal information of 100,000+ consumers/households
   • Derives 50%+ of annual revenue from selling/sharing consumer personal information

Key Exemptions

Sectoral Exemptions (Section 1798.145)

1. Healthcare/Medical Information:

• HIPAA-governed entities (c)(1)(A)
• Medical information under CMIA (c)(1)(B)
• Clinical trials and biomedical research (c)(1)(C)

1. Financial Services:

• Gramm-Leach-Bliley Act data (e)
• California Financial Information Privacy Act (e)
• Federal Farm Credit Act information (e)

1. Other Regulated Sectors:

• Driver's Privacy Protection Act data (f)
• Credit reporting activities (d)(1-2)
• Vehicle/vessel warranty information (g)(1-2)

Purpose-Based Exemptions (Section 1798.145)

1. Law Enforcement/Government:

• Compliance with legal obligations (a)(1)
• Law enforcement investigations (a)(2)
• Emergency access for government agencies (a)(4)

1. Other Purposes:

• Legal claims (a)(5)
• Vehicle/vessel repair and warranty purposes (g)(1-2)

Other Notable Exemptions

1. Personal/Non-Commercial:

• Personal/domestic use (l)
• Non-commercial activities protected by California Constitution (l)

1. Professional Communications:

• Business-to-business communications (n)(1)
• Employee-related information (m)(1) (until January 1, 2023)

1. Privileged Information:

• Communications protected by evidentiary privileges under California law (b)