In the United States, in addition to a federal law protecting student records (FERPA), there are other regulations that govern privacy at the state level. This is the case, for example, with California’s CCPA.
CCPA meaning
CCPA is the acronym for the California Consumer Privacy Act. It is a law that protects the personal information of California’s consumers and households. This regulation establishes the rights and obligations of consumers and businesses, respectively.
The CCPA applies to for-profit businesses, regardless of whether or not they are located in California, provided they:
- Process information of more than 100,000 consumers or households.
- Have gross revenues exceeding $25 million.
- Derive more than 50% of their revenues from selling/sharing consumers’ personal information.
CCPA regulation: entry into force and amendment
The CCPA entered into force on January 1, 2020. Three years later, the CPRA (California Privacy Rights Act) amended and expanded the requirements of the former.
It is important to note that these are not different laws, but a single regulation with amendments. Therefore, any part of the CCPA that was not revised continues to apply. In general, California entities and agencies continue to refer to the law as the CCPA or the amended CCPA.
Among the CPRA changes are more rights for consumers, such as the right to correct inaccurate information, and greater requirements for businesses, such as the need to obtain the consent of minors under 16 before selling or sharing their personal data.
If their age is under 13, the law requires parental consent, but if minors are between the ages of 13 and 15, they can grant their consent directly.
The law also introduces categories for sensitive personal information (Social Security number or SSN, biometrics, precise geolocation, health, sexual orientation, ethnic origin, and content of communications), allowing consumers to limit the use and disclosure of this data.
How does the CCPA protect exam takers?
California consumers are protected by the CCPA regarding the collection and processing of their personal data by businesses. For example, when exam takers complete a digital test using a monitoring system from an external provider.
The CCPA grants users (such as students, candidates, or workers who take a digital exam with SMOWL) the rights that we will see in the next section. To exercise these rights, users must:
- Consult the company’s privacy policy.
- Contact the company via the available channels (web forms, email, telephone, etc.)
- Verifiably identify themselves.
Businesses must respond within a determined period. In the case of requests considered unfounded or excessive, companies are permitted to limit the frequency of such requests, generally to two per year.
Do you want to stay on top of the latest trends in eLearning, EdTech, and Human Resources?
Fill out the form to receive our weekly newsletter with industry insights from our experts.
CCPA rights
The California privacy law guarantees the following civil action rights:
| Right to access the information collected by a business in the last year, and to know the purposes. | Right to delete collected information, with some exceptions. | Right to correction, to fix inaccurate data a business holds. | Right to opt-out of the sale of personal information to third parties. | ||||||||
| Right to limit the use and disclosure of sensitive personal information. | Right to non-discrimination for exercising privacy rights. | Right to bring civil action if data is compromised due to negligence. | |||||||||
CCPA requirements
Businesses, for their part, must comply with the following obligations:
| Ensure the exercise of the rights of the data subjects. | Inform consumers about the data collection, the reasons, and the purposes. | Implement a transparent privacy policy, with the option to opt out of the sale or transfer of personal data. | Respond to consumer requests.* | ||||||||
| Implement measures to prevent unauthorized access to information or security breaches.** | Ensure compliance by service providers (with contractual limited data use) and contractors or third parties. | Not discriminate against consumers for exercising the rights granted by the CCPA. | |||||||||
*Businesses are obligated to reply within the established deadlines: 10 business days for confirmation of receipt / 45 days, with a possible extension of another 45 days for requests to know, delete, and correct / 15 business days for requests to opt-out and limit the use of data. In any case, requests must include verification of the applicant’s identity to be processed.
**These measures include encryption in transit and at rest, access control, periodic security audits, vulnerability testing, an incident response plan, and a breach log.
CCPA compliance: does SMOWL adhere to the regulation?
Absolutely. Smowltech maintains internal procedures and controls, including DPAs (Data Processing Agreements), audits, and security policies, to comply with the CCPA/CPRA.
Contracting institutions and organizations can rest assured that the data of California users will be protected not only based on this regulation but also on the FERPA law, provided that the entities receive federal funds from the Department of Education.
In those cases, SMOWL acts under a contractual agreement, complying with the requirements of the FERPA law to protect students’ academic records.
For more information, we recommend consulting our privacy policy. If you have any concerns or questions about it or the treatment of the data we gather, feel free to reach out to us:
User Support Center
Portuetxe Kalea, 53 B, 20018 DONOSTIA/SAN SEBASTIÁN, GIPUZKOA
