The article provides an overview of how the EU Member States have modified their domestic data privacy law in the following core areas: (1) domestic legislation (2) definitions; (3) relevant authority; (4) registration requirements; (5) data protection officers (DPO); (6) collection and processing; (7) data subject rights; (8) data transfer to third counties; (8) security of personal data; (10) data breach notification; (11) enforcement; (12) data processing in employment context; (13) provisions relating to specific processing situations (chapter 9 GDPR); (14) electronic marketing; (15) online privacy; (16) other notable domestic regulations. EU Member States without finally adjusted domestic data privacy law are listed indicating the current status of the domestic legislative process.

In this article, you find an introduction of the California Consumer Privacy Act of 2018 and its unusual origins in a ballot measure (I.), and answers to key practical questions on who and what data is protected by the law (II.), who has to comply with its requirements (III.), how to achieve compliance (IV.) and what sanctions and remedies apply (V.). Then, you find a summary of new statutory damages for data security breaches and their impact on U.S. litigation exposure as well as practical recommendations for risk mitigation measures (VI.). Providing also a comparison with the EU GDPR (VII.), the article concludes with an outlook and suggestions regarding next steps (VIII.).