As many who have been tracking CCPA are aware, the law requires training employees who handle consumer inquiries, and ensuring that employees understand how to help consumers exercise their rights. Since most of those rights requests are arriving by web page, email, and phone, it is unlikely that rights requests will slow in the face of COVID-19. Indeed, it is possible that they may increase. Employees will thus still need training, something many companies had anticipated doing in-person.

In-person training is particularly useful to ensure employees adequately understand and digest CCPA requirements, and many coordinate with their law firms to put together such sessions. These trainings typically address not just CCPA-related privacy training requirements, but also training required under other privacy laws (GDPR, GLBA, HIPAA, to name but a few) and industry guidelines. Potential restrictions on group gatherings, corporations limiting travel, and employees working remotely puts in-person in jeopardy.

Rather than avoid privacy training, companies can tweak their existing training plans and make use of the myriad of virtual platforms available in this modern age. When doing so, companies do not have to sacrifice interactivity. As those who regularly use interactive tools can attest, they provide several useful features that can help gauge effectiveness of training. Chief among these is the simple video camera. For companies who have a culture of “camera off,” now is the time to shift to “camera on.”  Training programs should still, as would have been the case with in-person training, focus on measurable success. Do employees understand how to direct consumers to exercise their rights? Do employees who are gathering information know where to look? These issues and others should be covered in training.

Putting it Into Practice: As companies map out their CCPA training plans, they can work with legal counsel to move towards -effectively implemented, interactive- virtual training in light of COVID-19. This can help prepare for rights request responses and otherwise address privacy training requirements.