Pub. 8 2019-2020 Issue 2

18 San Diego Dealer A s the new year approaches, auto dealers now have limited time to ensure their data collection and retention practices are compliant with the far-reaching California Consumer Privacy Act (“CCPA”). The CCPA imposes new privacy regulations on all for-profit entities that collect and process the personal information of California residents and that meet at least one of the following criteria: (1) $25 million annual gross revenue, (2) 50% revenue derived fromsellingpersonal information, or (3) receive, buy, or share personal information relating to 50,000 consumers annually. Any auto dealer who meets at least one of these criteria must abide by the CCPA. Under the CCPA, consumers will have a right to know what personal information a dealer collects, sells, or discloses, the dealer’s business purpose for the col- lection or sale of the information, and the categories of third parties with whom the dealer shares that information. Consumers will have the right to request deletion of their personal information unless an exception applies. Consumers will also have the right to opt out of the sale of their personal information and be free from discrimination for electing to do so. Receiving a deletion request from a consumer also creates an obligation for the dealer to notify its service providers to delete the consumer’s personal information from their records. While complying with the CCPA’s requirements may seem daunting, the Governor has recently signed into law multiple amendments to the CCPA that allow auto dealers to be exempt from certain portions of the law. Credit Report Information Exemption Assembly Bill 1146 (“AB 1146”) exempts information collected pursuant to the Fair Credit Reporting Act (“FCRA”). This means the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer’s credit worthiness, credit standing, credit capacity, charac- ter, general reputation, personal characteristics, or mode of living by specified parties is exempt from the CCPA’s provisions. This exemption covers auto dealers and credit reporting agencies which collect and receive consumer credit report information. Accordingly, auto dealers may continue to accu- rately report and receive information from credit agencies. So long as the auto dealer collects and AUTO DEALERS EXEMPT FROMCERTAIN PORTIONS OF CALIFORNIA’S NEWPRIVACY LAW