Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps: Part 5 – Consumer Rights

Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps

Part 5 of a Series

Consumer Rights: Deletion, Do Not Sell, Non-Discrimination

The California Consumer Privacy Act obligates covered businesses to disclose the categories of personal information, the sources of personal information and uses of personal information collected in the course of their operations.  In addition, the CCPA gives consumers specific rights not just to know what data is being collected, but also whether and how that data can be used.  Compliance with the CCPA requires an understanding of these rights, and adoption of procedures to comply with them.

Deletion

Under Section 1798.105 of the CCPA, consumers have the right to request a business to delete “any personal information about the consumer which the business has collected from the consumer.” The business must fulfill such requests — and to direct “any service providers,” as that term is defined in the CCPA, to do the same — within 45 days of receiving a “verified request” or “verifiable request” from the consumer.  Businesses should be aware that the consumer’s right to delete is one of the provisions that must be included in the company’s privacy policy.

The right to delete is not absolute.  Businesses are also not required to delete information “if it is necessary” to:

  • Complete the transaction for which it was collected.
  • Provide a good or service the consumer has requested.
  • Perform a contract between the business and the consumer.
  • Detect security incidents.
  • Protect against “malicious, deceptive, fraudulent, or illegal” activities.
  • Prosecute people responsible for “malicious, deceptive, fraudulent, or illegal” activities.
  • “Debug to identify and repair errors that impair existing intended functionality.”
  • Ensure the exercise of free speech by another customer.
  • Ensure the company’s exercise of “another right provided for by law.”
  • Comply with a legal obligation, in particular, those of the California Electronic Communications Privacy Act.

These exceptions give businesses a broad range of reasons to keep information.  For example, a business may continue to use a consumer’s personal information that has been the subject of a deletion request “internally, in a lawful manner that is compatible with the context in which the consumer provided the information.” A similar exception is carved out for “solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.”

Opt-out of Sales

The CCPA gives consumers two related rights regarding the sale of personal information: 1) a “right to opt out” of the sale of personal information, and 2) for consumers under the age of 16, a “right to opt in”.

The right to opt out authorizes consumers to direct a business not to sell the consumer’s personal information. Related to this is a requirement that businesses that sell personal information must provide consumers with “explicit notice” that they may sell their personal information to a third party as well as “an opportunity to exercise the right to opt out” before any selling occurs. A consumer may exercise this right “at any time,” and may also authorize another person to opt out on their behalf. Businesses that are directed by a consumer or their designee not to sell their personal information may not do so “unless the consumer subsequently provides express authorization” for such sale. Once a consumer has opted out of the sale of their personal information, a business must wait at least 12 months before requesting that the consumer authorize its sale. Finally, any information the consumer provides in connection with their opt-out request must be used “solely for the purposes of complying” with that request.

For consumers under the age of 16, there is, in addition, a right to opt in, which requires businesses to obtain affirmative authorization from consumers between the ages of 13 and 16, and from the parent or guardian of consumers under the age of 13, before selling any of their personal information. This section of the CCPA also makes it clear that a business will be considered to have had actual knowledge of a consumer’s age if it “willfully disregards” their age. Operationally, an important question is whether failing to ask for or require a consumer to provide proof of age at the point of sale constitutes willful disregard of it.

The “do not sell” button

To meet their obligations regarding the “do not sell” rights in the CCPA, businesses must provide a “reasonably accessible” and “clear and conspicuous link” on their homepage, titled “Do Not Sell My Personal Information.” This link must enable a consumer to opt out of the sale of their personal information but must not require them to create an account in order to do so. The link must also describe the consumer’s rights pursuant to this section and must be contained in its online privacy policy or policies, as well as any “California-specific description of consumers’ privacy rights” that it maintains.  The California Attorney General has stated that it will provide details on the exact nature of the link, but has not yet done so.

While the homepage containing this link to the opt-out request is only required to be made available to California consumers, that would require a business to maintain “a separate and additional homepage that is dedicated to California consumers and that includes the required links and text,” as long as they have taken “reasonable steps” to ensure California consumers are directed to it.

Lastly, this section of the CCPA places obligations on businesses to ensure that “individuals responsible for handling consumer inquiries about the business’s privacy practices or the business’s compliance with this title,” for example, data protection officers, are informed of the relevant requirements and know how to direct consumers to exercise their rights.

Nondiscrimination

The CCPA also contains a non-discrimination provision in Section 1798.125 that relates to the prices and quality of goods and services a business provides to its consumers. To protect consumers who exercise their privacy rights under this law, the provision prohibits businesses from: (1) denying them goods or services; (2) charging them a different (i.e., higher) price; (3) providing them goods or services of a different (i.e., lower) quality; or (4) suggesting that (2) or (3) will occur. As the law states in a “complex and seemingly self-contradictory” exception, however, businesses may charge different prices or provide a different level or quality of goods or services to consumers that exercise their privacy rights “if the difference is reasonably related to value provided by the consumer’s data.”

As explained in the law, the bill thus “would authorize businesses to offer financial incentives for collection of personal information.” Financial incentives would include, for example, “payments to consumers as compensation … for the collection … sale … or the deletion of personal information.” Businesses that do offer financial incentives for the collection of consumers’ personal information must also notify consumers of these offers, and consumers must give businesses their “prior opt-in consent” to enter the program, which they may revoke “at any time.” Lastly, these financial incentives and the practices surrounding them must not be “unjust, unreasonable, coercive, or usurious in nature.”

The Value of Personal Information

In operational terms, the CCPA may prompt some businesses to specify the value of the personal data they collect from each consumer. This opens up numerous intriguing questions: How much is an email address worth? What about a phone number or home address? What is the relative value of other types of personal information that are mentioned in Section 1798.140 the law, such as a person’s “preferences, characteristics, psychological trends, … predispositions, behavior, attitudes, intelligence, abilities, and aptitudes”? If businesses do decide to offer financial incentives to customers to collect their personal information, it will be interesting to see how and by what means they price this information.

Read our other blogs in this series on Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps:

 Part 1 – the Data Map
 Part 2 – the Breach Response Plan
 Part 3 – the Privacy Policy
 Part 4 – Verified Requests for Data


Robert E. Braun
 is the co-chair of the Cybersecurity and Privacy Law Group at Jeffer Mangels Butler & Mitchell LLP. Bob helps clients to develop and implement privacy and information security policies, negotiate agreements for technologies and data management services, and comply with legal and regulatory requirements. He helps clients to develop and implement data breach response plans, and he and his team respond quickly to clients’ needs when a data breach occurs. Contact Bob at RBraun@jmbm.com or +1 310.785.5331.

JMBM’s Cybersecurity and Privacy Group counsels clients in a wide variety of industries, including accounting firms, law firms, business management firms and family offices, in matters ranging from development of cybersecurity strategies, creation of data security and privacy policies, responding to data breaches and regulatory inquiries and investigations, and crisis management. The Cybersecurity and Privacy Group uses a focused intake methodology that permits clients to get a reliable sense of their cybersecurity readiness and to determine optimal, client-specific approaches to cybersecurity.