CCPA Business Definition
The California Consumer Privacy Act (CCPA) refers to covered organizations as a business. Who is covered by the definition of a business? In short, it applies to for-profit organization doing business in California that satisfy one of three thresholds. It also applies to certain affiliated organizations with a covered business.
The definition of a business is found in Section 1798.140(c). The definition is divided into two parts. The first covers the threshold to be considered a business under the CCPA and the second covers related entities which are considered a business because of their ties to the covered business.
It applies to:
– A “sole proprietorship, partnership, limited liability company, corporation, association or other legal entitity” organized or operated for profit or financial benefit of its shareholders or owners;
– Collects personal information, or on the behalf of which such information is collected;
– Alone or jointly with others determines the purposes and means of the processing of consumers’ personal information;
– Does business in the State of California;
– meets one of the three thresholds for coverage (below).
The three thresholds for coverage are:
A. Gross revenues in excess of $25 million.
B. Annually buys, receives for commercial purpose, sells, shares for commercial purpose the personal information of 50,000 or more consumers, households or devices.
Note: The term consumers is defined as a California resident. Households and devices are not explicitly limited in the safe fashion by the latest amendment to this section (SB-1121).
Sell is defined in part as “selling, … making available, transferring, or otherwise communicating … a consumer’s personal information … to another business or a third party for monetary or other valuable consideration.”
Commercial Purpose is defined as “to advance a person’s commercial or economic interests”.
C. 50 percent or more of annual revenue from selling consumers’ personal information.
The term “business” is also applied to entities that are controlled by or controls a business and that share common branding with the business. This is contained in Section 1798.140(c)(2). Both control and common branding are defined by the law. Control includes controlling influence over management, control of the election of a majority of the board of directors, or ownership or the power to vote more than 50 percent of the outstanding shares of any class of voting security of a business. Common branding means a shared name, servicemark, or trademark. The text appears to require both control and common branding of a business (as defined by the CCPA) in order to qualify through this section.