New law may force small businesses to reveal data practices

NEW YORK — A Rhode Island software company that sells primarily to businesses is nonetheless making sure it complies with a strict California law about consumers’ privacy.

AVTECH Software is preparing for what some say is the wave of the future: laws requiring businesses to be upfront with customers about how they use personal information. California has already passed a law requiring businesses to disclose what they do with people’s personal information and giving consumers more control over how their data is used.

Privacy rights have gotten more attention since news earlier this year that the data firm Cambridge Analytica improperly accessed Facebook user information.

For AVTECH, which makes software to control building environmental issues, preparing now makes sense not only to lay the groundwork for future expansion, but to reassure customers increasingly uneasy about what happens to their personal information.

Aware that California was likely to enact a data law, AVTECH began reviewing how it handles customer information last year. Although most of the company’s customers are businesses, it expects it will increase its sales to consumers.

While it may yet face legal challenges, the California Consumer Privacy Act is set to take effect

Jan. 1, 2020.

Although many small businesses may be exempt, those subject to the law will have to ensure that their systems and websites can comply with consumer inquiries and requests. That may be an added cost of thousands for small companies that don’t have in-house technology staffers and need software and consulting help.

Under California’s law, consumers have the right to know what personal information companies collect from them, why it’s collected and who the businesses share, transfer or sell it to. That information includes names, addresses, email addresses, browsing histories, purchasing histories, professional or employment information, educational records and information about travel from GPS apps and programs.

Companies must give consumers at least two ways to find out their information, and companies must also give consumers a copy of the information they’ve collected.

Consumers also have the right to have their information deleted from companies’ computer systems, and to opt out of having the information sold or shared.