Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps
Part 5 of a Series
Consumer Rights: Deletion, Do Not Sell, Non-Discrimination
The California Consumer Privacy Act obligates covered businesses to disclose the categories of personal information, the sources of personal information and uses of personal information collected in the course of their operations. In addition, the CCPA gives consumers specific rights not just to know what data is being collected, but also whether and how that data can be used. Compliance with the CCPA requires an understanding of these rights, and adoption of procedures to comply with them.
The right to delete is not absolute. Businesses are also not required to delete information “if it is necessary” to:
- Complete the transaction for which it was collected.
- Provide a good or service the consumer has requested.
- Perform a contract between the business and the consumer.
- Detect security incidents.
- Protect against “malicious, deceptive, fraudulent, or illegal” activities.
- Prosecute people responsible for “malicious, deceptive, fraudulent, or illegal” activities.
- “Debug to identify and repair errors that impair existing intended functionality.”
- Ensure the exercise of free speech by another customer.
- Ensure the company’s exercise of “another right provided for by law.”
- Comply with a legal obligation, in particular, those of the California Electronic Communications Privacy Act.
These exceptions give businesses a broad range of reasons to keep information. For example, a business may continue to use a consumer’s personal information that has been the subject of a deletion request “internally, in a lawful manner that is compatible with the context in which the consumer provided the information.” A similar exception is carved out for “solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.”
Opt-out of Sales
The CCPA gives consumers two related rights regarding the sale of personal information: 1) a “right to opt out” of the sale of personal information, and 2) for consumers under the age of 16, a “right to opt in”.
The right to opt out authorizes consumers to direct a business not to sell the consumer’s personal information. Related to this is a requirement that businesses that sell personal information must provide consumers with “explicit notice” that they may sell their personal information to a third party as well as “an opportunity to exercise the right to opt out” before any selling occurs. A consumer may exercise this right “at any time,” and may also authorize another person to opt out on their behalf. Businesses that are directed by a consumer or their designee not to sell their personal information may not do so “unless the consumer subsequently provides express authorization” for such sale. Once a consumer has opted out of the sale of their personal information, a business must wait at least 12 months before requesting that the consumer authorize its sale. Finally, any information the consumer provides in connection with their opt-out request must be used “solely for the purposes of complying” with that request.
For consumers under the age of 16, there is, in addition, a right to opt in, which requires businesses to obtain affirmative authorization from consumers between the ages of 13 and 16, and from the parent or guardian of consumers under the age of 13, before selling any of their personal information. This section of the CCPA also makes it clear that a business will be considered to have had actual knowledge of a consumer’s age if it “willfully disregards” their age. Operationally, an important question is whether failing to ask for or require a consumer to provide proof of age at the point of sale constitutes willful disregard of it.
The “do not sell” button
While the homepage containing this link to the opt-out request is only required to be made available to California consumers, that would require a business to maintain “a separate and additional homepage that is dedicated to California consumers and that includes the required links and text,” as long as they have taken “reasonable steps” to ensure California consumers are directed to it.
Lastly, this section of the CCPA places obligations on businesses to ensure that “individuals responsible for handling consumer inquiries about the business’s privacy practices or the business’s compliance with this title,” for example, data protection officers, are informed of the relevant requirements and know how to direct consumers to exercise their rights.
The CCPA also contains a non-discrimination provision in Section 1798.125 that relates to the prices and quality of goods and services a business provides to its consumers. To protect consumers who exercise their privacy rights under this law, the provision prohibits businesses from: (1) denying them goods or services; (2) charging them a different (i.e., higher) price; (3) providing them goods or services of a different (i.e., lower) quality; or (4) suggesting that (2) or (3) will occur. As the law states in a “complex and seemingly self-contradictory” exception, however, businesses may charge different prices or provide a different level or quality of goods or services to consumers that exercise their privacy rights “if the difference is reasonably related to value provided by the consumer’s data.”
As explained in the law, the bill thus “would authorize businesses to offer financial incentives for collection of personal information.” Financial incentives would include, for example, “payments to consumers as compensation … for the collection … sale … or the deletion of personal information.” Businesses that do offer financial incentives for the collection of consumers’ personal information must also notify consumers of these offers, and consumers must give businesses their “prior opt-in consent” to enter the program, which they may revoke “at any time.” Lastly, these financial incentives and the practices surrounding them must not be “unjust, unreasonable, coercive, or usurious in nature.”
The Value of Personal Information
In operational terms, the CCPA may prompt some businesses to specify the value of the personal data they collect from each consumer. This opens up numerous intriguing questions: How much is an email address worth? What about a phone number or home address? What is the relative value of other types of personal information that are mentioned in Section 1798.140 the law, such as a person’s “preferences, characteristics, psychological trends, … predispositions, behavior, attitudes, intelligence, abilities, and aptitudes”? If businesses do decide to offer financial incentives to customers to collect their personal information, it will be interesting to see how and by what means they price this information.
Read our other blogs in this series on Complying with the California Consumer Privacy Act in 5 (more or less) Not So Easy Steps:
Robert E. Braun is the co-chair of the Cybersecurity and Privacy Law Group at Jeffer Mangels Butler & Mitchell LLP. Bob helps clients to develop and implement privacy and information security policies, negotiate agreements for technologies and data management services, and comply with legal and regulatory requirements. He helps clients to develop and implement data breach response plans, and he and his team respond quickly to clients’ needs when a data breach occurs. Contact Bob at RBraun@jmbm.com or +1 310.785.5331.
JMBM’s Cybersecurity and Privacy Group counsels clients in a wide variety of industries, including accounting firms, law firms, business management firms and family offices, in matters ranging from development of cybersecurity strategies, creation of data security and privacy policies, responding to data breaches and regulatory inquiries and investigations, and crisis management. The Cybersecurity and Privacy Group uses a focused intake methodology that permits clients to get a reliable sense of their cybersecurity readiness and to determine optimal, client-specific approaches to cybersecurity.