FAQ: California Consumer Privacy Act (CCPA)

What is CCPA?

• It is the California Consumer Privacy Act (CCPA).
• CCPA was enacted on June 28, 2018 and becomes effective on January 1, 2020.
• CCPA grants consumers new rights regarding their personal information.
• It sets out the responsibilities of businesses in relation to:
  1. the transparency under which they must operate with regard to personal information; and
  2. the rights they must give to California consumers and households with regard to their personal information.
• For more information, be sure to visit Sage's CCPA page at https://sage.com/ccpa.

Does the CCPA apply to my company/organization?

It applies to for-profit companies, doing business in California, that collect California consumers’ personal information, or companies which have such information on their behalf must comply with the CCPA, if they meet any of the following thresholds:

• Annual gross revenues more than $25 million
• Annually buys, receives for its commercial purposes, sells, or shares for commercial purposes personal information relating to 50,000 or more consumers, households, or devices
• Derives 50% or more of its annual revenue from selling consumers’ personal information.

Is Sage 300 CRE CCPA-ready?

Yes, Sage 300 CRE version 18.4 and later is CCPA-ready and gives you the tools to comply with the rules enacted by the CCPA.

Do I need to disclose the consumer’s rights in relation to their personal information?

It is your company's responsibility to disclose your customer's rights in relation to their personal information you are collecting.

Does Sage 300 CRE help me not to share personal information of anyone under 16 years of age unless the consumer has expressly opted in?

• Sage 300 CRE does not have the ability to share personal information except where needed by Sage customers at the need of the business for daily business operations (not for sale).

Does Sage 300 CRE help me to not request opt-in for personal information sharing consent more frequently than once every 12 months?

Sage 300 CRE does not, and will not have feature functionality to request opt-in to sell your consumer's information. Therefore, Sage 300 CRE will not have the ability to request this more than every 12 months. You can use custom fields to track your information. See How do I setup a Custom Field? Contact your business partner if you need assistance.

If a consumer asks to disclose the request history, how do I get the information from Sage 300 CRE?

Sage 300 CRE will not be tracking request history automatically. Reporting the requests will only be possible if you manually track the requests by using custom fields on the applicable records. See How do I setup a Custom Field? and contact your business partner if you need assistance.

How do I provide my customers a “do not sell my personal information” capability?

Sage 300 CRE does not have a field to specify opt-in to sell personal information. If you have developed a way to provide this capability to your consumers, you can create a custom field in Sage 300 CRE to track the request. See How do I setup a Custom Field?

How do I provide at least two methods for consumers to submit a request for disclosure of personal information?

Your company will need to decide on what methods they will provide their customers to submit a request for disclosure.

How do I verify the consumer’s identity?

Because your consumers do not interact with Sage 300 CRE, you will need to verify the person's identity before entering the personal information into Sage 300 CRE.

How do I track format of disclosure required by consumer?

Sage 300 CRE does not track request history so reporting the format of the request is not possible.

How do I classify personal information according to category and purpose?

Sage 300 CRE does not have fields for classifying personal information.

How do I create a disclosure report of stored personal information?

Sage 300 CRE version 18.4 and later includes several reports in the Reports folder for you to use. See DocLink: What Consumer Privacy reports does Sage 300 CRE provide?

How do I create a disclosure report of sold personal information?

You can create custom fields to track the date of when the information was sold and the type of information sold, and then create a report. See How do I setup a Custom Field? and contact your business partner if you need assistance with a report.

Does Sage 300 CRE ensure that any disclosure reports can be saved as electronic files?

All reports generated from Sage 300 CRE can be saved as a PDF.

How do I delete personal information if requested to do so and I have no valid reason to retain it?

You can delete information from your Sage software, however, bear in mind that some information may be required. For example, the social security number is a required field on the Payroll Employee setup.

See How do I remove or clear personal information from Sage 300 CRE modules?

How do I avoid discrimination against consumers?

• Your company is responsible for avoiding discrimination against consumers.
• Sage 300 CRE does not (and will not) contain features solely for the purpose of enabling any listed form of discrimination against consumers.

How do I respond to disclosure requests within 45 days?

• You can create custom fields to track the date of the request and the type of the request. See How do I setup a Custom Field?
• Disclosure reports can be run at will in Sage 300 CRE to allow you to be able to respond to requests. Requests will not be tracked inside the software. In turn. responding in the allotted time is your responsibility.

Can Sage 300 CRE help me provide disclosures free of charge?

Aside from the data disclosure reports provided by Sage, you are responsible for creating custom disclosure reports.

It is up to your company to provide disclosures free of charge.