Shift Magazine - February 2020 - 9

JAN

2020

A CLOSER
LOOK AT
THE CCPA
The California Consumer
Privacy Act went into effect
Jan. 1. Experts say it's the
most stringent and sweeping
privacy law in the country.
Here's a look at key provisions
and ramifications.

"This is totally a big deal," said Lisa Joy Rosner, chief marketing officer at Otonomo,
an Israeli company that provides a data-services platform linking automakers and
third-party vendors. "It's top of mind. It's something I'm having conversations about
every day."
Working with 15 automakers around the world, Otonomo has developed apps and
anonymization tools that give consumers greater control over what information they
share with car companies. Recently, the company helped its European customers prepare for and comply with the General Data Protection Regulation, better known as
GDPR, in the European Union. GDPR was something of a model for the California law,
which attorneys said is the most stringent in the United States.
While the law itself is new, the underlying friction between privacy rights and vehicles has been brewing for a while. Rosner foresaw the headache on the horizon.
A friend had purchased a certified pre-owned vehicle from a local car dealership.
She typed "home" into the embedded navigation system and immediately received
directions to the home of the car's former owner. A few more clicks, and she accessed
a trove of information on the previous owner's location history.
Whether the responsibility for erasing that data lies with the former owner, the dealership or the automaker remains uncertain. But it's paramount such issues be addressed,
says Rosner, who has compiled a "privacy playbook" at Otonomo that guides automakers through issues of data privacy and consumer trust.
"Privacy is a fundamental human right," she said. "Our data is us. In 2020, it should
be a human right to control how your data is used."
But at the same time California codifies some rights into law, many automakers
say data access is essential to making some features work. In some extreme cases,
data-sharing is a requirement to purchase a vehicle. What happens if a consumer declines

* Companies must let
consumers know what
data they collect, why
they're collecting it and
which 3rd parties they
intend to share it with.
* Companies must notify
customers when they intend
to monetize their data.
* Consumers must be given
a means to delete personal
information collected and
stored by businesses, and
they have the right to opt
out of the sale of their
personal information.
* Though there are similarities
between CCPA and Europe's
General Data Protection
Regulation, they have
separate scopes and
requirements. A business
that complies with GDPR
may have additional
obligations under CCPA,
according to the California
Attorney General's Office.

see CCPA, p. 10
february 2020 * shift

Shift Magazine - February 2020

Table of Contents for the Digital Edition of Shift Magazine - February 2020