Search Menu

How the CCPA Will Affect Federal Contractors

OMB Acquisition Reform Proposal 1 – Acquisition Test Programs

Beyond the Size Standards – Business Focused Breakfast, Jul 30, 2019

Popular Now
Guest Author
July 24, 2019
Dark Light
© andranik123 – Fotolia.com

This is a guest post by Jonathan T. Williams and David T. Shafer of PilieroMazza PLLC.

The California Consumer Privacy Act (“CCPA”) will go into effect on January 1, 2020. Similar to the European Union’s General Data Protection Regulation (“GDPR”), CCPA creates significant compliance challenges for government contractors and commercial businesses doing business in California, with several states following suit. Under CCPA, fines from the Attorney General for businesses that do not comply could be as high as $7,500 per violation, with CCPA also granting consumers the right to bring private action, exposing companies to actual and statutory damages.

Preparing for CCPA

To prepare for CCPA’s January 1, 2020 effective date, first determine if you fall within CCPA’s compliance criteria. Critically, the statutorily defined terms “consumer” and “personal information” are far broader than most statutes and regulations. The enlargement of these terms causes CCPA’s jurisdiction to be larger than it appears on the face of the statute. Below are certain high-level questions that can help a business determine if it meets certain threshold standards:

  • Do you, or any of your subsidiaries or affiliates, engage in business in California?
  • Do you do business with contacts or employees who reside in California?
  • Does your business have over $25 million in annual gross revenues?
  • Does your business buy, sell, or receive personal information?

If you fit certain initial criteria, we recommend identifying the type of personal information your business collects. As briefly mentioned above, CCPA broadly defines personal information as any information that directly or indirectly identifies, describes, or can be reasonably linked to a particular consumer.

Similar to GDPR, CCPA grants consumers significant rights to the use or their personal information, including general notice rights. It is here that companies can take proactive steps to prepare for CCPA’s implementation. More specifically, CCPA grants consumers the right to know what personal information a business collects, sells, or discloses about them. Additionally, several sections of CCPA require businesses to make affirmative disclosures to consumers by way of privacy policies and other notices.

In addition to the various privacy policies that are required under CCPA, other reasonable steps include conducting regular training programs for employees, crafting tailored intellectual property rights contracts, and instituting third-party commercial contracts to ensure that CCPA’s requirements are adhered to.

Looking to the future

CCPA was originally drafted as a ballot initiative before being transitioned into a statute in a relatively short timeframe. Because of this, CCPA has already been through a series of amendments, with many more amendments still before the California legislature.

More and more states are slated to follow California’s lead, including Hawaii, Maryland, Massachusetts, Mississippi, Nevada, North Dakota, New Mexico, New York, Rhode Island, and Washington. If these states decide to enact similar legislation, it will have a far-reaching effect on government contractors and commercial businesses that conduct business in those regions. In light of GDPR, CCPA, and these recent developments, the possibility of federal legislation being enacted is high. Businesses should prepare now to preempt the potential impact.

Attorneys in PilieroMazza’s Cybersecurity & Data Privacy Group are well-versed in this area of the law, and will continue to monitor CCPA developments, as well as the litany of other states that are in various stages of implementing additional privacy statutes and regulations. For more information concerning CCPA, click here to contact them directly.

This blog post originally appeared on the PilieroMazza blog at https://www.pilieromazza.com/impact-of-california-consumer-privacy-act-on-government-contractors-and-commercial-businesses and was reprinted with permission.

Related posts:

  1. Labor Law Changes That Will Affect Small Business Federal Contractors
  2. How NDAA 2014 Will Affect Small Business Contractors
  3. Why the NDAA is So Important to Small and Mid-Size Federal Contractors
  4. New Legislation Affects Federal Contractors in Construction
  5. New Legislation Affects Specially Certified Federal Contractors
Related Posts

The All-Small Mentor-Protégé Program

SBA had a well-established mentor-protégé program (MPP) for SBA 8(a) certified firms but lacked an MPP program for other small business concerns and specifically, one for specialized certified concerns such as WOSB, EDWOSB, SDVOSB, & HubZone. The 2010 Jobs Act and 2013 NDAA gave SBA the authorization to address this by establishing an all-encompassing mentor-protégé program. Ms. Sandi Clifford, deputy director of the All Small Mentor-Protégé Program (ASMPP), visited the Mid-Tier Advocacy (MTA) earlier this year to discuss the program. Here are some of the highlights of this candid and informative discussion: As Ms. Clifford explained, mentor services to protégés include: • Management and technical assistance (internal business management systems) • Financial assistance (in the form of equity investments and/or loans) • Contracting assistance (contracting processes, capabilities acquisitions and performance) • International trade education (learn how to export, international trade business plan, finding markets) • Business development assistance (strategy, finding contracting and partnership opportunities) • General and/or administrative assistance (business processes and support) As administrators of the program, SBA provides: • Central HQ as opposed to 8(a) distributive model • Online application – certify.sba.gov • Online course tutorial requirement • Annual review and evaluation • Template agreements, i.e., MPA (Mentor-Protégé Agreement) Other All-Small Mentor-Protégé Program (ASMPP) details: • A protégé may generally only have one mentor at a time; SBA may approve a second (two is the maximum) where no competition exists, or if the protégé registers under a new NAICS or otherwise requires new mentor skills.  • Both protégé and mentor must be for-profit (with exception of protégé being an agriculture cooperative). • A mentor may have no more than three protégés at same time (no lifetime limit). • A participant can be both a protégé and mentor at the same time, if there is no competition or conflict. • The ASMPP is self-certifying and is open to businesses who qualify as small in their primary NAICS code, or who are seeking business development assistance in a secondary NAICs where they also qualify as small.  • SBA will not authorize MPAs in second NAICS in which firm has never performed any work; or where firm would only bring “small” status to Mentor and nothing else. • Existing 8(a) firms in last 6 months of the 8(a) program may transfer their MPA to the ASMPP via the online application process. Coordinate with 8(a) office to fine tune the process but there is no reapplication required. • Application requirements include upload of business plan, but no financial statements or tax returns. • JV agreements: ASMPP will not review and approve joint venture agreements. How to apply for the ASMPP: • Applicants are required to register in the System for Award Management (SAM) prior to submitting their mentor/protégé application. • Complete your business profile in certify.SBA.gov. • Evaluate and select your mentor prior to applying. This is not a matching program. SBA will not find a mentor for you. • Begin the ASMPP application process. • Protégés and mentors must complete the online tutorial and have their certificate of completion and all other required documents ready for upload Thank you to Sandi Clifford, Deputy Director, All Small Mentor-Protégé Program, for this helpful overview. TAPE has mentored several small businesses over it’s life as a large business (we’re large in some NAICS codes, though still small in others) and it has been gratifying, satisfying, and integral to our success. As protégés ourselves, we have benefitted from working with some really classy large businesses, and have also had the experience of being a protégé and really getting no tangible benefits. We are currently working with two small businesses, and negotiating ASMPP agreements. You can learn more about the ASMPP on the SBA site. To join MTA and attend future events like this one, please visit www.midtier.org.
Bill Jaffe
August 23, 2017
css.php