Data & AI

Data Fabric and Data Lineage are two terms we see a lot – on websites, in blogs and technical papers – but what’s the relevance? What do we really need to understand about our data and its power?

Manta and Talend send their data experts to visit the Innovation Sandbox. Ernie Ostic (M) and Rolf Heimes (T) answer questions about data and explore its significance in today’s new normal – all delivered with a dose of their personal style and passion for the topic.

Watch now.

National Geographic named him the Wizard of Big Data. He works on innovation, national security and privacy with government leaders, think tanks and executives all over the world. And now, Jeff Jonas is talking with you from inside the Innovation Sandbox!

The California Consumer Privacy Act (CCPA) was created to provide consumers in the state of California with additional rights and protections related to how businesses are permitted to use their personal information. This state statute was enacted in 2018 and put into effect in January 2020.

In this article, we’ll take a look at what the CCPA is and how the CCPA impacts businesses and consumers.

What Is The Purpose of CCPA?

In the past few years, customers have expressed growing concerns about the fate of their personal data in the hands of businesses and corporations. The purpose of the CCPA is protect the data and privacy of consumers. The CCPA endows residents in the state of California with the following rights:

• The right to be informed that personal data is being collected, used, sold, and/or shared by businesses
• The right to request for the deletion of personal data
• The right to prohibit businesses from selling their personal information
• The right to access any personal data collected by businesses
• The right to not be discriminated against (higher prices, lower levels of service, etc.) for exercising these rights

In the event that these rights are breached, the CCPA grants California residents the right to sue.

What Is Personal Information?

It is important to know what personal information is to have a good understanding of the implications of the CCPA. The CCPA defines personal information as the following: “Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” (1798.140.o1).

The different categories of personal information under the CCPA are direct identifiers, unique identifiers, biometric data, geolocation data, internet activity, and sensitive information. Examples of direct identifiers include first and last name, social security numbers, and home address. Unique identifiers refer to data like account names, cookies, and IP addresses. Location history is the primary example of geolocation data. Internet activity refers to browsing history and search history. Biometric data encompass voice and face recordings. Finally, health data is an example of sensitive information.

Overall, any data that can be used to identify an individual or a household is considered personal information under the CCPA. Data that is anonymous or aggregated generally is not covered by the CCPA. In some cases, suppression of data may be necessary to prevent the Identification of specific individuals or households by inference or by combining multiple sources of anonymous or aggregated data.

Which Businesses Must Abide by the CCPA?

Not all businesses must abide by the CCPA. There are certain requirements that a company must fulfill before being forced to comply with this state statue. The following companies are required to abide by the CCPA:

• Companies that earn more than $25 million in annual gross revenue
• Companies that collect the personal information of at least 500,000 residents, households, and/or devices in California each year
• Companies that derive more than half of their annual revenue from selling the personal information of California residents.

Notably, companies outside of the state of California are also expected to comply with the CCPA. After all, most of the businesses in the United States do business with consumers in California. Also, many other states have enacted similar legislation. Some examples of such states include Washington and New Jersey.

Are B2B Businesses Exempt from the CCPA?

“No” is the short answer to the question “Are B2B businesses exempt from the CCPA?” However, in truth, the answer is a little more complicated than that. The CCPA is not entirely black and white when it comes to business-to-business (B2B) companies. According to the CCPA, all communications and transactions that occur during the process of a business providing or receiving a product/service are exempt from the CCPA. Therefore, it appears that B2B businesses are exempt from the CCPA in terms of emails and other forms of communication. This exemption is only in place until January 2021.

However, B2B companies must still comply with the CCPA when it comes to allowing individuals to say no to the sale of their personal information and making sure consumers who exercise their data privacy rights are not exempt.

Overall, while there are some short-term exemptions that B2B companies are currently enjoying, the CCPA does have major implications for B2B companies. It is in the best interest of B2B companies to take advantage of these short-term exemptions to make the transition to this new normal for data privacy laws a little less rocky.

What Is the Difference Between the CCPA and the GDPR?

One question that you may have is “What is the difference between the CCPA and the GDPR?” The GDPR, which stands for the General Data Protection Regulation, is a regulation pertaining to data privacy in the European Union as well as the European Economic Area. The GDPR also regulates the transfer of personal information in areas other than the EU and EEA.

The GDPR was enacted in May 2018 to standardize data privacy laws across all 28 countries in the EU. The GDPR requires businesses to protect the personal data associated with all transactions occurring in the EU. This includes US businesses conducting transactions in the EU.

The main difference between the GDPR and the CCPA is that the latter only protects the privacy and data of California residents. On the other hand, the GDPR is only applicable for transactions in the EU. Another key difference is that the primary focus of the CCPA is to regulate the sale of personal information. The main focus of the GDPR is to regulate data ownership and the rights to personal data deletion.

What Does the CCPA Mean for Businesses?

The CCPA requires that all residents of California must know what personal data is being collected and how this information is being used. However, the CCPA may mean that businesses may need to grant these new data privacy rights to all customers. The reason for this is that it is often difficult for a business to know for sure where a user is located. Therefore, for many businesses, it is in their best interest to blindly apply the CCPA rights to all customers due to the inability to distinguish between consumers from California and consumers from other states. Also, as noted above, many states are working to enact statues similar to the CCPA.

Businesses can face civil penalties of $2,500 per violation under the CCPA and up to $7,500 for all intentional violations. In general, a business will first receive notification of alleged noncompliance. If the business fails to rectify the violation within 30 days, the business will be considered in violation of the CCPA and may face civil penalties and civil actions for injunctions from the California attorney general. As mentioned above, California residents are able to sue businesses for violations as individuals or classes.

How Should Businesses Prepare for the CCPA?

There are a number of steps that businesses should take to prepare for the CCPA. These steps include updating their website and ensuring personal data security. This section will outline how businesses can adequately prepare for the CCPA.

All businesses should update the privacy policy on their website to ensure the personal data they collect is clearly outlined. Not only should the privacy policy mention what personal data is collected, but it should also explain why it is stored and how it is processed and used. A section of your website should provide your consumers with clear instructions on how to make a request to access their personal data. You can provide a toll-free telephone number that consumers can call to make a right-to-access request. Provide a thorough explanation of how your business intends to validate the identity of individuals who make right-access requests.

Under the CCPA, the California Attorney General has the power to impose fines in the event of a breach of personal consumer information. However, these penalties are only applicable to businesses that did not take the right steps to protect personal data.

Be sure that all the personal information you collect from your consumers is encrypted. Redaction is another method that you can use to protect the personal information of your California consumers. Not only do you need to protect the data through encryption or redaction, but you may need to completely restructure the way you collect and store data to ensure that you have the ability to find personal information no matter where it is stored. The reason is that consumers can make right-to-access requests, which means you need to be able to find and provide this data in an efficient manner. As you can imagine, this can be a very time-consuming and difficult process.

In Conclusion

In conclusion, the CCPA has the potential to have national and even global implications when it comes to data privacy for consumers. California was the first state in the county to enact legislation to protect consumer data and privacy. Many states are expected to follow suit in the next few years. For more information about what is the CCPA, don’t hesitate to contact us.

The CCPA (California Consumer Privacy Act) helps give Californians new rights to autonomy over data they generate. It went into effect on January 1, 2020. This act is the first major US privacy legislation that is being enacted after the European GDPR (General Data Protection Regulation), which became effective in May 2018. While some have called the CCPA the California GDPR, there are some differences.

CCPA vs. GDPR

Even though Nevada and Maine have passed different privacy legislation or amendments to existing laws, the CCPA is the first statewide privacy legislation in the country. The CCPA is of different magnitude than other laws and other amendments to laws. This law in California changes the way residents can handle their own data. It can empower them with new rights in order to request businesses delete or disclose the data that has been collected or they can completely opt out of third-party data sales. The law now creates new requirements for commercial entities that are doing business in California. Whether or not a business falls under these new requirements depends on a set of definitions. The main requirement under this is that the businesses are to provide consumers with information about how their data has been processed, collected, and sold in the past 12 months.

While the CCPA only affects one state, the GDPR is a European Union law that is for all 27 member-states. This law controls how companies, organizations, and websites are allowed to handle personal data. Personal data can be anything from browser history and email addresses to location data, names, and other things. If you have a website with visitors from the EU and you have a third-party service, such as Facebook or Google, that processes personal data then this law states that you need to first get prior consent from the user. In order for the consent to be valid, it needs to be based on clear information about the duration, extent, and purpose of the data processing. For example, if you are doing this through a cookie consent banner then the banner can’t have any pre-checked boxes. This law actually applies to any website in the world, regardless of where you are located and from where you are operating. If you get any visitors from the European Union then you need to be in compliance. Even if the website is in California but gets visitors from the EU, it still needs to follow the GDPR.

Overall Comparison of CCPA vs. GDPR

CCPA is more about creating transparency and giving rights to consumers while GDPR is more focused on creating a “privacy by default” framework. The GDPR instead creates a door for a user to lock so that none of their data can be processed. The CCPA creates a window that allows a consumer to find out where there data has been sold to a third party or gathered by a business.

Legal Bases

The GDPR requires that businesses, websites, and companies have a legal basis for processing personal data in the EU. The first legal basis is consent. However, the CCPA doesn’t have this same framework. Under the CCPA, a business doesn’t actually need prior consent from a user before they process the data and a website doesn’t need any prior consent from a user before they sell the data to a third party.

Main Rights of Each Law

Both of the laws deal with some main rights that include the right of access, to be informed, and portability. The minor difference between the two is the right of prior consent and the right to opt out. These can almost be seen as the same since the right to opt out is also included in the right to withdraw consent.

When you compare the right of each one closely, it’s prior consent that makes all the difference. Prior consent is exclusive to GDPR. With this, it can create the legal framework across the European Union that is based on privacy first with user control.

What Do the Laws Deal With?

Both laws define things a bit differently. The CCPA deals with personal information and this is information that relates to, describes, identifies, or is capable of being associated with a particular consumer or household, whether it’s linked directly or indirectly. The GDPR deals with personal data or any information related to an identifiable natural person indirectly or directly. The CCPA definition is more personal and this means it includes data that isn’t necessarily individual specific but can also be categorized as household data. However, the GDPR does have a special category of data that is called Sensitive Personal Data.

The GDPR has created six different legal grounds for processing personal data. However, the CCPA doesn’t have any for processing that data in the state. This means that businesses can process data as they want, unless a customer actually exercises their right to opt out of having the data sold. This is shown in the requirement for businesses to provide a link or button on the website that says, “Do not sell my personal information.” By clicking this button, consumers can opt out of these third-party data sales.

Who Do the Laws Apply to?

The laws have some differences on who is affected, whether it’s individuals or businesses.

Data Subjects vs. Consumers

The CCPA gives rights to consumers and this is a person who is a California resident. The GDPR protects what are known as data subjects, defined as identifiable or identified natural persons. A data subject can be any person and doesn’t necessarily have to be a EU citizen or resident. For example, if an American citizen is traveling in the EU and their data is processed while there, he or she is then protected by the GDPR. The companies that process the data, even if they are outside the EU, still have to comply if they are offering services to data subjects within the union.

Scopes of the GDPR and CCPA

Both laws have extraterritorial scope. The CCPA applies to companies that fit the definition of a business, whether or not the company is actually located in California. A business, according to the law, is a for-profit entity that collects personal information, does business in California, and determines the means and purpose of processing. They must meet one of these thresholds: process information for at least 50,000 Californians every year, annual revenue over $25 million, or gets 50% or more of its revenue from the sale of personal information. This definition excludes a lot of websites, organizations, and companies that do process personal data of Californians and still allows them to do business as usual.

A company that is based in Europe can still fit into the definition of a business under the CCPA and is obligated to comply the law. The GDPR applies to organizations, companies and websites in the world if they offer services or goods to individuals within the EU. The difference is that the GDPR actually protects the data subject who happens to be in the EU at the time of the processing or collection of data. However, the CCPA only protects you if you fall under the definition of being a California resident.

The GDPR doesn’t set any restrictions for the size of profit of the data collectors. A data controller, according to the law, is just any entity that processes or collects data in the European Union. This can include any company, organization or business, and website. This is one of the main differences between the two laws and the GDPR has a much broader scope. The GDPR protects more people.

Enforcement of the Laws

When it comes to the enforcement of the laws, both are similar but there are some differences.

The GDPR is enforced by monetary penalties issued by the national data protection authorities. Penalties can be as high as 4% of a company’s global annual turnover or 20 million euros, whichever is higher. The fines are determined by the gravity, nature, and how long the infringement was. So far, the highest fine has been 50 million euros. The CCPA is being enforced by the Attorney General of California, also with monetary penalties. However, the monetary penalties for the CCPA are much smaller than ones issued for violating the GDPR. There is a maximum of $2,500 per violation.

According to the GDPR, it’s the national data protection authorities that have the task for offering guidance and promoting awareness to organizations and companies on how to be GDPR compliant. The EU data protection authorities have the ability to conduct audits of companies that could be in breach of the GDPR. They are allowed to order data controllers to comply and issue warnings. With the CCPA, there aren’t as many supervisory opportunities and it’s up to the state’s Attorney General to start any investigations. The Attorney General is expected to have created regulations to specific areas of supervision and enforcement by July 2020.

The CCPA and GDPR do a lot to help with privacy but there are more limitations to the CCPA than there are the GDPR and each law works a bit differently.

The state of California is now enforcing the California Consumer Privacy Act (CCPA). Starting July 1, businesses face fines of $2,500 per compliance violation, rising to $7,500 if negligence is involved. On top of that, Californians can sue if their personal information is compromised in a data breach—again, if due to company negligence. This makes implementing robust CCPA compliance solutions an urgent priority.

Under California Consumer Privacy Act requirements, Californians have the right to:

• Know what personal information of theirs is collected, used, shared, or sold
• Request deletion of their personal information
• Opt-out of the sale of their personal information

Why CCPA Compliance Solutions Start with Data Knowledge

Achieving CCPA data privacy best practices—much like GDPR compliance before it—begins with understanding your customers’ personally identifiable information (PII). You must be able to answer:

• What data do you store?
• Where is the data?
• Who has access to the data?
• What is the data being used for?

This means data governance for CCPA compliance is inseparable from broader initiatives in data management and data security.

Choosing the Right CCPA Compliance Solutions and Tools

There are countless tools claiming to support California data privacy regulations. When evaluating any CCPA compliance assessment software, make sure to ask:

Are You Scanning All My Data?

Some tools only scan file names, column headers, or samples. You need CCPA data scan tools that can deep scan structured, semi-structured, and unstructured data across servers, email systems, shared drives, cloud, and on-premises. Comprehensive CCPA unstructured data scanning ensures you uncover every hidden pocket of PII.

Can the Solution Learn as It Goes?

Look for solutions that use AI for CCPA compliance. Artificial intelligence and machine learning (AI/ML) detect hidden data relationships and create rules that enhance CCPAdata classification and inventory accuracy over time. The benefits of AI/ML in CCPA data privacy solutions include continuous learning and improved data quality insights.

What Will the Data Scan Deliver?

Expect a full inventory of data assets with reports on locations, quality, classifications, and sensitivities. This forms the basis for CCPA personal information protection decisions. A quality-first approach eliminates long debates over definitions by letting the system set rules up front.

How Long Will the Scan Take?

High-quality solutions can complete deep scans in days rather than weeks. Speed matters when aiming to prepare for CCPA compliance efficiently.

Will the Solution Continue to Work for Me?

Compliance isn’t “one and done.” New data constantly flows into your organization. The best tools offer ongoing CCPA compliance monitoring tools to ensure you remain compliant long-term.

How Prolifics Can Help

If you’re wondering how to prepare for CCPA compliance, our experts can help assess your readiness. We offer a CCPA compliance health check services package—an inventory and risk assessment that gives you a clear understanding of your exposure.

We also provide deep data scanning for CCPA compliance through our Data Hawk accelerator, a key technology in any data privacy project. Data Hawk delivers unmatched scanning and interrogation capabilities for both structured and unstructured data.

Whether you need to know questions to ask CCPA data scanning vendors or want to learn what is a CCPA compliance health check, our team has the answers. We ensure our recommendations align with California Consumer Privacy Act requirements and best practices for CCPA personal information protection.

The Business Case for Compliance

Failing to meet CCPA data privacy best practices is costly—not only in fines but also in reputational damage. Investing in CCPA compliance solutions that integrate with your broader data governance for CCPA compliance strategy reduces legal risks and strengthens customer trust.

By embedding AI for CCPA compliance and scalable CCPA data scan tools into your infrastructure, you’ll be better positioned to adapt to evolving California data privacy regulations and other emerging laws.

Ready to protect your data and your reputation? Visit our expert hub for resources on how to protect personal information under the California Consumer Privacy Act or email us at solutions@prolifics.com to get started.

Description

Verus Financial is innovating the way insurance companies are measured to meet the expectations of their policies and, most importantly, their clients. Trust comes at a cost, and when you are purchasing life insurance, you want to be sure that the money you leave behind falls in the right hands.

Enter Verus Financial, who developed a sophisticated approach to ensure that a life insurance policy is paid appropriately, and that if no heir remains, the funds are paid back to the state where the policy is held. This approach, which began as a small grassroots effort, has ballooned into a profitable business model. Verus is now planning to partner with each state to ensure that taxes are being corrected accurately. Verus is creating a new business to measure businesses and individuals and audit taxation records to ensure each state is collecting taxes in an optimal fashion.

Transcription

Peter Lee, CTO/CIO of Verus Financial:

The name of the game for us is really to detect, identify, document and follow up all the compliance events so we’re sort of doing forensics work if you will. We actually analyze millions and millions of records. So the only way we can do that is using data analytics IBM has been the business enabler and the foundation for Verus Financial and that is not a…that’s really not a commercial statement. That’s the truth.

We use the IBM software to prepare the data, we run through the statistics, we analyze the data, we detect patterns, we detect abnormal situations or simply normal events or data and so all of those capabilities allow our analysts being able to do their job better and we also can do a much deeper analysis. Prolifics, really I can’t say enough good things because they’re very responsive, they deliver what they say they would and are very helpful. Really, we see them as an integral part of our business planning. For me for example, every technical purchase, every project we, do we involve them.

Connecting Healthcare Across Supply Chains

APIs on FHIR are redefining how healthcare systems connect, exchange data, and deliver better patient outcomes. They combine modern API technology with the global Fast Healthcare Interoperability Resources (FHIR) standard to enable secure, standardized, and fast healthcare data sharing across systems and borders.

API technology is the disrupter-in-chief of many sectors, especially retail and banking. Some of this disruption is driven by regulation that will inevitably be replicated: from open banking to open insurance, open pensions, and so on. The healthcare industry is one of the latest to expand its traditional reach and create new ways to connect across supply chains by opening up APIs.
Healthcare’s digital transformation has been spurred by FHIR (Fast Healthcare Interoperability Resources), the industry standard for exchanging healthcare data. As PSD2 is to banking, these regulations ensure a standard structure of information, making data accessible and readable outside of a central system. First trialed in the United States, FHIR has quickly expanded as an international specification to resolve administrative and clinical challenges in healthcare networks around the globe, making a notable impact in the US.

From Regulation to Reality

While regulation often sets the stage, the real magic happens when technology moves beyond compliance into value creation. For healthcare, this means more than simply meeting data standards—it’s about enabling better care, smoother workflows, and more connected patient journeys.

Consider how banking APIs have reshaped the customer experience, allowing real-time payments, account aggregation, and intelligent financial insights. The same principle applies in healthcare: APIs on FHIR can securely link disparate systems, empowering healthcare providers and patients alike. By ensuring data moves effortlessly between hospitals, clinics, pharmacies, insurers, and even research institutions, FHIR sets the foundation for true healthcare interoperability.

FHIR Solutions In Practice

The possibilities aren’t hypothetical—they’re already happening. In open healthcare platforms, APIs are authenticating healthcare providers, enabling referrals to both clinical and community-based services. The UK’s NHS is in the beta stage of building a national API network—a system where registered patient records can be securely located and accessed by any authorized physician, care worker, or healthcare administrator, provided the patient has given consent.

The implications are profound. Imagine walking into any urgent care facility or hospital, even in a different country, and having a doctor instantly access your full medical history with a single API call. Seconds later, another API call could securely send your updated prescription to a pharmacy—eliminating errors, speeding up treatment, and ensuring continuity of care.

Better Patient Experience

In industries like banking, open APIs have redefined customer experience. In healthcare, the same transformation is underway. Patients are gaining the power to make informed decisions about their treatment, based on easy access to their aggregated medical history. And it’s not just patients who benefit—researchers, public health officials, and policymakers can securely analyze anonymized data to inform population health strategies, pandemic responses, and clinical innovation.

There’s also powerful cross-industry potential. For example, private and public healthcare institutions can tap into insurance APIs to verify coverage instantly, ensure accurate billing, and prevent claim disputes. This level of healthcare interoperability minimizes paperwork, reduces delays, and improves trust across the entire ecosystem.

Why FHIR Is Winning Over Developers and Providers

One reason FHIR adoption is accelerating is its simplicity and cost-effectiveness. It’s free, open, and designed for fast implementation—earning its “fast” label for a reason. Developers appreciate its human-readable serialization format, which means they can build and integrate new interfaces in days, not months. For healthcare organizations, this translates into quicker deployments, lower costs, and faster returns on investment.

The global growth of FHIR signals that healthcare providers are eager to embrace APIs as a practical solution to the industry’s complexity. It’s not about replacing existing systems—it’s about connecting them in a way that’s secure, standardized, and future-proof.

Prolifics Can Help

At Prolifics, we’ve seen firsthand how transformative APIs on FHIR can be. Our work spans healthcare clients across North America and the UK, including organizations like BMI Healthcare and GSK. Drawing on deep experience with API architectures, integration platforms, OAuth security, and cloud deployments, we’re helping healthcare organizations unlock the full potential of FHIR.

We’ve even begun repurposing assets from our open banking projects—leveraging lessons from another highly regulated industry to accelerate healthcare interoperability initiatives. This includes creating FHIR sandboxes where healthcare organizations can experiment, prototype, and validate their API strategies before rolling them out at scale.

The Road to Global Healthcare Interoperability

So, are we close to achieving global healthcare interoperability? The short answer: closer than ever, but still on the journey. Technical standards like FHIR have solved much of the “how” when it comes to connecting healthcare systems. Now, the remaining challenges are largely operational—governance, consent management, cross-border data sharing laws, and aligning incentives across public and private stakeholders.

But momentum is building. Governments are recognizing the value of open standards. Healthcare organizations are increasingly API-literate. And technology partners like Prolifics are providing the architecture, security, and integration expertise to make large-scale API network deployments not just possible, but practical.

The Bigger Picture

The endgame is a healthcare ecosystem where APIs work quietly in the background—instantly connecting the dots for clinicians, patients, researchers, and insurers. A patient’s data could travel securely and seamlessly across hospitals, GP clinics, pharmacies, and labs—no matter the software vendor or geographic location. Emergency care would improve, chronic disease management would become more personalized, and administrative inefficiencies would be drastically reduced.

In short, APIs on FHIR are not just a tech trend—they’re a foundational step toward a healthcare system that is more connected, more efficient, and more human-centered.

What’s Next?

For healthcare leaders, the question is no longer if FHIR-based healthcare interoperability will happen—it’s how quickly you can get there and how prepared your organization is to lead, not follow.

If you’re ready to explore what APIs on FHIR can do for your organization—whether you’re looking to streamline provider workflows, improve patient outcomes, or unlock new cross-industry opportunities—Prolifics can help you navigate the journey with proven expertise and innovative solutions.