Data Protection Laws Are Here, But What Do They Mean for California Businesses?

Jordan Yallen and Kevin D. DeBré

Jordan Yallen is a second-year Juris Doctor candidate at Loyola Law School Los Angeles. Jordan is a Staff Editor of the Loyola of Los Angeles Law Review and the Social Events Chair of Loyola’s Innovation, Entrepreneurship, and Startups Club. In the summer of 2018, Jordan interned for Ashley Boardman at Silicon Beach Legal, PLC, where he focused on researching the GDPR and analyzing organizational policies and protocols regarding compliance with the regulation.

Kevin D. DeBre is a partner with Stubbs Alderton & Markiles, LLP in Los Angeles, California, where he is the chair of the firm’s Intellectual Property and Technology Transactions Practice Group.

If information is the lifeblood of every business, then data is the oxygen enabling businesses to thrive. Digital technologies have simplified the collection, analysis, storage, sharing, and manipulation of data. Along with these improvements, digital technologies have also brought a surge of new regulations governing how companies may use collected data. Recent laws enacted to protect consumer privacy and address data security risks are just the first wave of a vast regulatory regime within which most businesses must soon operate. These companies will rely upon their counsel to ensure that they are in compliance with this fluid landscape of privacy laws. This article highlights the responsibilities associated with collecting and using personal data through an analysis of two significant, recently adopted privacy laws: the European Union’s General Data Protection Regulation ("GDPR") and the California Legislature’s recent passage of Assembly Bill No. 375, the California Consumer Privacy Act of 2018 ("CCPA").