The California Consumer Privacy Act takes effect Jan. 1, 2020, with major implications for a raft of businesses who collect, store, trade and sell personal information.

Three data privacy lawyers discussed the nuances and myths associated with the landmark new law during a comprehensive discussion Wednesday morning, saying many aspects of the new law are poorly understood by businesses that will have to significantly alter operations.

“The California Consumer Privacy Act of 2018 is arguably the most expansive piece of privacy legislation in U.S. history,” the law firm Morrison Foerster announced prior to the discussion.

The law mandates businesses disclose the categories of private information they collect on consumers, give consumers a right to opt out of the sale of their personal information, the right to delete their private information and the right to receive copies of specific pieces of their personal information.

“So much still remains in flux,” said Christine Lyon, a partner with Morrison Foerster. “There are a lot of important and tricky issues which have been referred to the California Attorney General to figure out and issue rules.”

But Lyon, along with fellow partners Mary Race and Kristin Matthews, said there are elements of the law known at present although not necessarily well understood.

One such aspect is that despite the law’s origination in California, it covers all businesses conducting commerce in the Golden State and not solely operations headquartered or based in California.

“You have to consider how the CCPA will reach beyond California’s borders, both in the U.S. and globally,” Race said.

Another little-understood nuance of the law is that requests for personal information can only be made for data going back 12 months.

“It does create a landmark new right to access personal information,” Lyon said. “But that right is much narrower than the first look might suggest.”

Deletion requests are also likewise limited by the law in subtle ways. For instance, companies only have to delete information upon request that they have collected directly from the consumer. Information collected in indirect ways can be stored even after deletion requests are made, Matthews said.

One of the other notable effects from the passage of the CCPA is its ability to set precedent for other states to follow. For instance, Nevada has passed its own version that is set to take effect sooner. Overall, 17 other states are considering versions of the CCPA as the public grapples with the fallout from Cambridge Analytica and the data-mining business models of huge corporations like Facebook and Google.

— By Matthew Renda