{"id":3668,"date":"2018-11-06T13:07:23","date_gmt":"2018-11-06T17:07:23","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=3668"},"modified":"2018-11-06T13:07:23","modified_gmt":"2018-11-06T17:07:23","slug":"ccpa-compliance-cory-cowgill-fusion-risk-management","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/ccpa-compliance-cory-cowgill-fusion-risk-management\/","title":{"rendered":"CCPA Compliance with Cory Cowgill of Fusion Risk Management"},"content":{"rendered":"

\"CCPA<\/p>\n

The European Union\u2019s GDPR compliance mandate has radically changed the way the world thinks about data security, data privacy, and identity in the modern age. For the time being, it only affects enterprises, including enterprises based in the U.S, with customers in the EU. However, the California Consumer Privacy Act (CCPA) might change that.<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

What is the CCPA? How will it affect your enterprise? What do you need to do to prepare? We spoke with Cory Cowgill, Chief Technology Officer at<\/span> Fusion Risk Management<\/span><\/a>, for more information. <\/span><\/p>\n

Here\u2019s our conversation, edited slightly for readability: \u00a0<\/span><\/p>\n

Solutions Review: The California Consumer Privacy Act (CCPA) will come into effect on January 1, 2020. What are the biggest takeaways for enterprises about this new law? <\/b><\/h4>\n

Cory Cowgill: On June 28, 2018 the California Consumer Privacy Act (CCPA) was passed and signed into Law by California\u2019s Governor. With an effective date of January 1, 2020, this gives businesses that have customers in California a little over one year to be prepared to comply with these obligations.<\/span><\/p>\n

As anyone who has been required to meet the standards of the European Union\u2019s famous General Data Protection Regulation (GDPR) can attest\u2014meeting these extensive privacy regulations is a very involved, detailed and, at times, confusing process. Many enterprises doing business in the EU are still working on meeting GDPR obligations, even though it went into effect this past May. The most important action that companies doing business in California can do is start preparing immediately for CCPA. January 1, 2020, will be here before we know it. If planning doesn\u2019t start now, organizations will be scrambling later in 2019.<\/span><\/p>\n

SR: What is the impact CCPA on enterprise data retention and security? How do enterprises currently handle data retention?<\/b><\/h4>\n

CC: Companies that underwent a GDPR program, and have implemented procedures and processes to meet this obligation, will be in excellent shape for the CCPA. <\/span><\/p>\n

However, many U.S.-based companies that thought they would not be impacted by GDPR are now in the position where it will no longer be optional to comply with these privacy obligations, now that CCPA has been passed in the United States. As California is the largest state by population in the U.S., almost all businesses of scale have at least one customer there.<\/span><\/p>\n

SR: How does CCPA compare to GDPR? Will GDPR compliance suffice for CCPA compliance? How many enterprises are ready for CCPA compliance?<\/b><\/h4>\n

CC: The CCPA has many of the same principles as GDPR. These include the right for consumers to know what data companies have on them, how that data is being used, the right to delete that data, and the obligation of the business to appropriately safeguard that data from a data breach. <\/span><\/p>\n

GDPR was really only the first drop in what will soon be a flood of data privacy regulations in the U.S.\u2014at both the state and federal levels\u2014and throughout the rest of the world.<\/span><\/p>\n

New data privacy regulations will certainly not end with CCPA.<\/span><\/p>\n

A Janrain survey<\/span><\/a> found that 69 percent of American consumers would like to see privacy laws like GDPR enacted in the U.S. When asked which of the GDPR provisions they\u2019d most like to see enacted, 38 percent responded with the ability to control how their data is used while 39 percent favored the \u201cright to be forgotten\u201d rule, which allows individuals to make a written request to have their data deleted by companies that are storing it.<\/span><\/p>\n

I would say that there are many companies out there who are not ready for CCPA. That is based on the lack of preparation among enterprises after GDPR went into effect. Organizations should take a lesson from the issues that were inherent in GDPR preparation, and work to avoid those when getting ready to comply with CCPA.<\/span><\/p>\n

SR: What do you recommend enterprises do to prepare for CCPA?<\/b><\/h4>\n

CC: Enterprises can ensure they meet these obligations, and future privacy obligations by investing in a risk management system to run their privacy programs. A comprehensive system will provide the scalability, consistency, and security that is required to meet these ongoing obligations. They must be able to track all elements of their preparation\u2014who is responsible for which items, when deadlines are coming up, who is collaborating, etc. A full risk management program makes this much easier to manage and control.<\/span><\/p>\n

One survey<\/span><\/a>, conducted by law firm McDermott Will & Emory and the Ponemon Institute during the weeks leading up to GDPR going into effect, found that 40 percent of respondents said their companies would not be compliant until after the deadline, while 52 percent of respondents said their organizations would be ready by that date. The remaining eight percent said they weren\u2019t sure when their organization would be compliant. <\/span><\/p>\n

This is largely due to the fact that companies could not efficiently track and manage the entire process of meeting GDPR\u2019s guiding. Companies do not want to be similarly unprepared when CCPA goes into effect. Again, I would highly recommend starting preparations now\u2014and doing so with a tool that keeps the process as streamlined as possible.<\/span><\/p>\n

Thanks again to Cory Cowgill, Chief Technology Officer at <\/b>Fusion Risk Management<\/b><\/a><\/span> for his time and expertise. <\/b>\u00a0<\/span><\/p>\n

Other Resources:\u00a0<\/strong><\/span><\/p>\n