The California Consumer Privacy Act (CCPA) has had a big impact on businesses all over the world regarding how they handle consumer data, but its application is not universal. In many ways, the CCPA is not as all-encompassing as its EU counterpart, the General Data Protection Regulation (GDPR). Though this may lessen the overall burden on businesses as they become compliant, it can create some confusion about when the CCPA does and does not apply.

Here we’ll cover the most important situations where the CCPA doesn’t apply.

When an Organization Is Not a “Business”

The first dividing line that determines whether the CCPA applies is the law’s definition of a “business,” because only businesses are required to be in compliance. Under the CCPA, a business is a for-profit entity that collects consumers’ personal information, does business in California, and meets at least one of these criteria:

• Has annual gross revenues in excess of $25 million
• Annually buys, sells, or shares the personal information of at least 100,000 consumers or households
• Derives 50% or more of its annual revenues from selling consumers’ personal information

Using this definition, the CCPA does not apply to many companies because they do not meet these threshold requirements. Also, because of the for-profit requirement, the CCPA does not apply to government entities or most nonprofits. Some nonprofits may still be bound by the data privacy law if they share common branding with and are controlled by a business to which the CCPA applies.

Learn more about what is personal information under the CCPA.

When Other Laws and Regulations Apply

When it comes to data protection and privacy, some industries are already regulated by state and federal law. The CCPA exempts data to which these laws apply, to avoid conflicting rules and obligations. These laws include:

The Health Insurance Portability and Accountability Act (HIPAA) – HIPAA typically relates to medical information, and already provides for the confidentiality and security of this data. The CCPA therefore does not apply to many healthcare providers and related businesses, at least to the extent the data collected is covered by HIPAA.

The Gramm-Leach-Bliley Act (GLBA) – The GLBA applies to banks and other financial institutions, and includes rules about how they must treat nonpublic personal information about their consumers. The CCPA does not apply to personal data that is already subject to the GLBA.

The Fair Credit Reporting Act (FCRA) – The FCRA deals with information that is collected and supplied to credit reporting agencies for the purpose of performing background checks. If the data is already covered by the FCRA, then the CCPA doesn’t apply.

Learn more about CCPA exemptions for HIPAA, the GLBA, and the FCRA.

‍

‍