Legal Alerts

Travel Law Update: California Consumer Privacy Act

For tour operators and travel-related companies doing substantial business in California, there is recent legislation which will affect how and whether you are able to collect, control and disseminate the personal information of California residents.

In June 2018, California passed the California Consumer Privacy Act. The Act aims to protect California residents from the threat of data breaches by giving residents specific rights related to their online privacy.

The Act requires, among other things, that businesses, including many travel entities, make general disclosures (via a website privacy policy) and specific disclosures (in response to a particular consumer’s request) about the personal information the business has collected about the consumer, from where it was collected, for what purposes it is being used, whether it is being disclosed or sold, and to whom it is being disclosed or sold. In addition, consumers will have the option to bar companies from selling their personal data, and children under 16 must opt into allowing businesses even to collect their information at all.

To comply with the law, businesses will need to take a number of actions including, but not limited to:

  • Proactively determining what personal data they are collecting from individuals and for what purposes
  • Updating their privacy policies every 12 months to make the disclosures the Act requires
  • Providing at least two means for consumers to submit requests for disclosure including, at a minimum, a toll-free telephone number and Web site
  • Being prepared to assemble, free of charge, requested information within a short period of time pursuant to a consumer’s request
  • Supplying a link titled “Do Not Sell My Personal Information” on the business’s homepage (the “opt out” right)
  • For consumers under 16 years of age, securing affirmative consent prior to selling their personal information (the “opt in” right)

The Act takes effect in 2020, and only applies to businesses meeting certain data collection and/or financial thresholds, for example, annual gross revenue of $25,000,000 (it is unclear at this point whether this number includes only a company’s California revenue or its global revenue, but if there are no changes the language is susceptible to a gross worldwide sales analysis).

?It is anticipated that the Act will be amended prior to its effective date. However, the Act likely will be a significant headache, and it is likely that similar regulations will spread to other states.

?As always, if you have questions, please do not hesitate to call either Rodney Gould, Robert Mueller or Melissa Paradis.