markdown The California Consumer Privacy Act (CCPA) uses the factor of "Processing by Local Establishment" to determine its applicability to businesses operating in California. This factor extends the law's scope to entities that collect and process personal information of California consumers while doing business in the state. ## Text of Relevant Provision CCPA Section 1798.140(d)(1) states: "(1) A sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers' personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information, that does business in the State of California, and that satisfies one or more of the following thresholds:" ## Analysis of Provision The provision establishes three key elements for determining the CCPA's applicability: 1. "collects consumers' personal information": This covers entities that directly gather personal data from California residents or have it collected on their behalf. 2. "determines the purposes and means of the processing": This language mirrors the GDPR's definition of a data controller, indicating that the CCPA applies to entities making decisions about how and why personal data is processed. 3. "does business in the State of California": This phrase extends the law's reach to entities with a local presence or conducting business activities within California. The provision also sets specific thresholds that must be met for the CCPA to apply, which are not detailed in the given excerpt but are crucial for determining the law's scope. ## Implications This factor has significant implications for businesses: - Companies physically located outside of California may still be subject to the CCPA if they collect personal information from California residents and meet the specified thresholds. - Businesses must assess their data collection practices and California-related activities to determine if they fall under the CCPA's jurisdiction. - Entities that process data on behalf of others (service providers) may have different obligations compared to those that determine the purposes and means of processing. - The broad definition of "doing business" in California could potentially capture a wide range of commercial activities, including online transactions with California residents. By focusing on local establishment and business activities, the CCPA aims to protect California consumers' privacy rights regardless of where the business is headquartered, as long as it has sufficient connections to the state and meets the specified criteria.