UC Irvine Law Review

On May 25, 2018, the European Union’s (EU) General Data Protection Regulation (GDPR) came into effect. The GDPR is expected to reshape web use and overhaul data privacy laws beyond Europe in how businesses and organizations can handle customer and user information. Only a month after, California passed the California Consumer Privacy Act of 2018 (CCPA). The CCPA is one of the most significant regulations overseeing data-collection practices of businesses in the United States. It is the first of its kind and is expected to provide the most comprehensive data privacy measures in the United States. As such, the combined CCPA and GDPR data privacy regulations will likely usher in a tidal wave of changes, most likely setting new data privacy standards for other jurisdictions to model.

Drawing from these events, this Note will examine the EU’s and California’s newest data privacy laws, studying the immediate and potential effects of GDPR and CCPA regulations on the existing data privacy regime. Through a comparative study of GDPR and CCPA provisions, this Note attempts to answer key questions in discourse today—to what extent are the CCPA and GDPR moving towards convergence or divergence, and how will the laws affect businesses and consumers? Is the U.S. data privacy environment veering away from its hands-off approach and drawing closer to the comprehensive approach of the EU data privacy regime? This Note will explore these questions looking at two particular provisions in the GDPR and CCPA: (1) the opt-in vs. opt-out consent and (2) the right to be forgotten/right to delete personal data.

Lastly, this Note analyzes the practical implications of the GDPR and CCPA regulations on businesses in terms of how receptive businesses are to the regulations, how well businesses strive to conform to the regulatory boundaries of data privacy regimes, and whether the regulations will have the intended effect of strengthening consumer rights by putting heavier restrictions on businesses.