The California Consumer Privacy Act (CCPA),to beeffective in 2020, was intended to give that state's residents new sweepingprotections. Residents have the right to

• know what personal data is being collected about them;
• know whether their personal data is sold or disclosed and to whom;
• opt out of the sale of their personal data;
• access their personal data; and
• utilize services, even if they exercise their privacy rights.

The law applies to any business that either has annual gross revenues in excess of $25 million, holds personal information on 50,000 or more consumers, or earns more than half of its revenue from selling personal data.In thebusiness world where information is usually the key to making money, personal information isusedto make business decisions. Some critics pointed to calls for legislation that would apply restrictions and penalties to any business of any size. "Better to go after the big fish," arguedone person, who then added,"What we are looking for is patterns of abuse and systemic issues. We're not trying to go after the local grocery store that sends an e-mail inappropriately."

What are the legal and ethical issues surrounding privacy protection? What are the obligations of businesses when it comes to privacy rights? Should the obligations of larger corporations be different from the obligations of smaller businesses? Why are there laws such as the CCPA? Should eachpersonhave the right to tell companies not to sell personaldata? Should the California Consumer Privacy Act (CCPA) be drafted and enacted as a Federal law? Should only large corporations be subjected to the law, or should smaller organizations, such as the local grocery store, be targeted as well?