Most companies slow to automate CCPA compliance

Despite enforcement of the California Consumer Privacy Act coming online earlier this month, many companies are still struggling to comply with the far-reaching state regulation. But it’s not just a lack of understanding about the CCPA’s requirements that is holding them back. It’s also a lack of automation and factors outside their control, according to a new survey of 121 U.S.-based companies by cybersecurity and cloud services company Akamai.

Complying with CCPA requirements are still a somewhat manual process for many companies. Only around a third of survey respondents, for example, said they fully automated showing or allowing customers access to their personal data. Even fewer, 23%, did the same for customer requests to have their data deleted. However, 43% were able to fully automate customers opting not to have their personal data sold by the company.

According to the survey, at least half of all respondents received these four CCPA requests at some point. Less common, however, were customer requests about if and to whom the company sold their private data, at 38% of companies, and those ensuring the company wasn’t discriminating against customers because they exercised their CCPA privacy rights, at 22%.  These two last requests were automated by only 21% and 28% of companies, respectively.

Steve Winterfeld, the advisory CISO at Akamai, noted one of the biggest hurdles to companies automating their CCPA compliance is the fact many don’t store customer data in one central location. He explained that companies often use third-party providers that have access to their customer data regulated by the CCPA.

“Now you have data in a lot of places, and so to automate something like ‘what information do you have about me,’ you have to pull from multiple places. And to build a system that can integrate all that can be very difficult,” Winterfeld said.

For some companies, he added, building such a system isn’t economical. “Part of that is how many people are going to require this. … If five people want their data to be deleted, automating it doesn’t make financial sense, you won’t get a return on investment,” he said.

Most companies said the CCPA compliance challenges they faced were both internal and beyond their control. Slightly less than half of all respondents cited a lack of consistency between the CCPA and other privacy regulations (47%) , and a lack of visibility into what data they hold (46%) as a barrier to compliance. Around 40% also said inadequate technology infrastructure and inadequate implementation time were challenges, while 36% cited a lack of data education.

Winterfeld noted the challenge of “data education” includes making sure all departments and employees within a company understand how to comply with CCPA. For example, “you don’t have marketing go hire a company that is not compliant with the requirements,” Winterfeld said. He said companies have to make sure “data is treated in accordance to those corporate policies that allow the company to be compliant.”

While attorneys have a pivotal role making sure employees adhere to regulatory requirements, they are often not the ones overseeing their organization’s CCPA compliance. According to the survey, most companies either relied on their chief information officer, 32%, or their chief technology officer, 29%, to manage their compliance effort, while only 18% gave the responsibility to their chief legal officer. Nine percent also had their chief customer officer spearhead the effort, while 8% turned to their chief privacy officer and 3% their chief marketing officer.