CCPA compliance (California Consumer Privacy Act) requirements shook up many business processes. Remaining compliant with the regulatory landscape is an ongoing, non-trivial challenge. Over the last decade, there has been a significant evolution of the regulations guiding the use of consumers’ personally identifiable information (PII). Failure to comply with regulations such as the CCPA or the General Data Protection Regulation (GDPR) can result in significant penalties.
CCPA Compliance Impacts Many Business
The CCPA is a state statute intended to enhance privacy rights and consumer protection for residents of California, United States. This act applies to any business, including any for-profit entity that collects consumers’ personal data, does business in California, and satisfies at least one of the following thresholds:
- Has annual gross revenues in excess of $25 million
- Buys or sells the personal information of 50,000 or more consumers or households; or
- Earns more than half of its annual revenue from selling consumers’ PII
This includes any retail bank that operates in California.
SoHo’s client was a Californian bank that required a consumer privacy process for customers to submit to the bank’s compliance team for action. This process needed to address the CCPA compliance requirements for consumer’s transparency rights. These rights require companies to inform consumers about all personal data collected and how it is shared. Consumers have the right to not only access this data, but to demand that it is deleted, and to opt-out of direct marketing arising from leveraging such personal data.
The Solution
CCPA compliance requires excellent data-management strategies
SoHo designed, built, and deployed a consumer privacy form and workflow process to allow customers to submit CCPA requests to the bank’s compliance team for approval and action.
The solution also required SoHo to work with the bank’s outside privacy counsel to design and implement an approach to identify and manage the PII data fields that concerned customers’ data privacy rights. Further, record management was configured to adhere to the bank’s new retention schedule by classifying files into Record Types, while putting automated retention tags in place to manage the content’s lifecycles in compliance. These tagged submissions were applied throughout the organization.
This process encompassed both identifying and managing access to sensitive data, whatever its source – customers, employees, or suppliers.
The Outcome
Not only was the bank confident that it met CCPA compliance requirements, it saw increases in the efficiencies of its administrative processes:
- Internal agents reduced time spent working submissions by 20%
- Contact time with each customer was reduced
- Form completions reached 98% (a massive improvement on the original process which often resulted in drop-offs and required contact intervention)
