When GDPR went into effect in May, it was expected that the European law would touch a lot of U.S. payment companies because of their international scope. Now it's clear that even purely domestic U.S. firms will have to adhere to some version of the data-privacy law.
California Governor Jerry Brown signed the
For financial technology companies, card issuers and merchant acquirers, the California law applies many of the same pressures that GDPR does. The state law, which goes into effect in 2020, requires more transparency for third parties that handle data. It affects any company that uses application programming interfaces, software development kits and other open development tools to build e-commerce interfaces or digital payment gateways.
Businesses will have to be more aware of the risk management and breach protection/response policies of the companies they do business with.
"The California law is similar to GDPR and it speaks to the privacy issues that are clearly outlined in GDPR," said Joe Prempeh, the global director of Data Privacy and Protection for Donnelley Financial Solutions, a Chicago-based data technology company.
There are a few important differences that make the California law weaker than GDPR. The European law gives consumers the right to ask companies to stop collecting information, while the California law gives people the option to ask companies to delete information or stop selling it—but the California law does not prevent companies from collecting information in the first place. There's also a chance technology industry
But the rules governing data sharing and breach notifications for merchants that do business in California will certainly be stronger, and any partnership with or acquisition of a California company will bring an added data compliance burden.
"When one company acquires another, the acquirer takes on all of the risk under the California legislation," Prempeh said. "The acquirers could find themselves in a very delicate situation."
The California law is coming at a time when most companies are still grappling with how GDPR impacts their business. About
The European law has already
These types of projects will accelerate as the California law adds more confusion to data compliance.
"Similar to GDPR, this could impact companies doing business all over the U.S. GDPR is about citizens or residents of the EU/EEA ," said Michael Hiskey, head of strategy at Semarchy. "If the California Consumer Privacy Act is the same, how do I know if a California resident isn't standing in New York or Chicago? So I have to do it for everyone."
To be on the right side of common sense data accountability, the only answer is to be ready with the "lowest common denominator" approach, or to wrap up customer data with a strong understanding of the "master" record for each customer and govern that data so that a company can provide it if asked or erase it, Hiskey said.
"The nice part is that it's like brushing your teeth. By forcing organizations to do this, they get ancillary positive benefits," he said. "It's like clean teeth and preventing gingivitis, but in this case, better customer data and avoiding regulatory fines for noncompliance.”
