Comparing CCPA to GDPR – 2021

Employers and the CCPA
New Draft Guidelines Attempt to Clarify Territorial Scope of the GDPR
ScopeNCA residents personal data collectedEU personal data processed
Right to accessNRight to access California personal data collected in the last 12 months, delineated between sold and transferredRight to access all EU personal data processed
Right to portabilityNAll access requests must be exported in user friendly formatMost export and import certain EU personal data in a user friendly format
Right to correctionXNot included in CCPARight to correct errors in EU personal data processed
Right to stop processingNRight to opt-out of selling personal data only; must include opt out link on websiteRight to withdraw consent
Right to stop automated decision makingXNot included in CCPARight to require a human to make decisions that have a legal effect
Right to stop third party transferNRight to opt-out of selling personal data to third partiesRight to withdraw consent for data transfers involving second purposed of special categories of data
Right to erase dataRight to erase personal data collected, under certain conditionsRight to erase EU personal data, under certain conditions
Right to equal services and priceBExplicitly requiredAt most, implicitly required
Private right to action of damagesNMin $100, Max $750 per consumer per incidentNo min/max
Regular enforcement penaltiesBCeiling of 4% of global annual revenuesNo ceiling – $7,500 per violation