This is the eighth part of a series of articles examining the most impactful provisions of the California Privacy Rights Act, the consumer privacy ballot initiative that amends the currently in force California Consumer Privacy Act. In the previous piece, I examined the main requirements for businesses regarding right-to-know requests from consumers. This piece turns to other consumer rights expanded upon by CPRA: the rights to deletion, no retaliation and children’s privacy.
Right to delete
Section 1798.105, Consumers’ Right to Delete Personal Information, contains the key provisions for the right to delete. Leaving the basic framework established by the CCPA intact, the CPRA provides consumers with a right to request a business “delete any personal information about the consumer which the business has collected from the consumer.”
Most importantly, the right to delete has been modified by the CPRA so businesses that receive a consumer deletion request must notify and instruct third parties who have purchased or received the consumer’s personal information to delete it, while some service providers and contractors must also transmit deletion requests downstream. Section 1798.105(c)(3) states a service provider or contractor, at the direction of the business, “shall delete, or enable the business to delete and shall notify any of its own service providers or contractors to delete,” the consumer’s personal information it has “collected, used, processed, or retained.” The service provider or contractor also “shall notify any service providers, contractors or third parties who may have accessed personal information … to delete the consumer’s personal information unless this proves impossible or involves disproportionate effort.”
As with other privacy rights protected by the CCPA/CPRA, businesses must also disclose to consumers their right to request deletion of their personal information pursuant to Section 1798.130, Notice, Disclosure, Correction and Deletion Requirements. Specifically, this section requires a business that collects personal information make available in a form that is “reasonably accessible” to consumers, “two or more” of the designated methods for requests for deletion, “including, at a minimum, a toll-free telephone number.”
Another relevant amendment introduced by the CPRA allows a business that operates “exclusively online” and has “a direct relationship” with the consumer from whom it collects information to “only … provide an email address for submitting requests” pursuant to Section 1798.105 — as well as for Sections 1798.106, 1798.110 and 1798.115.
Section 1798.130(a)(1)(B) also requires businesses that maintain an “internet website” to make the website “available to consumers to submit … requests for deletion,” pursuant to Section 1798.105, as well as pursuant to requests for information to be disclosed and requests for correction.
An important exception for the right to delete is that businesses need not comply with Section 1798.105 “to the extent the verifiable consumer request applies to a student’s grades, educational scores, or educational test results that the business holds on behalf of a local educational agency.” However, if a request falls under this exception and the business does not comply with it, it must notify the customer that it is acting pursuant to this exception, as laid out in Section 1798.145(q)(1).
A related exception to the right to delete is found in Section 1798.145(r), which states the right to delete requirements do not apply “if the consumer has consented to the business’ use, disclosure, or sale of that information to produce a physical item, including a school yearbook containing the consumer’s photograph,” as long as three conditions apply:
- The business incurred “significant expense in reliance on the consumer’s consent.”
- Compliance with the consumer’s request to delete “would not be commercially reasonable.”
- The business complies with the request “as soon as it is commercially reasonable to do so.”
As laid out in Section 999.313 of the final text of the CCPA regulations, responding to requests to delete involve, at a minimum, the following steps for businesses:
- Confirming receipt of the requests within 10 business days and providing information about “how the business will process the request,” including a general description of the business’s “verification process” and when the consumer should expect to receive a response.
- Responding to the request to delete within 45 calendar days, beginning on the date the business receives, not verifies, the request. If the request takes longer than 45 days, the business may take an additional 45 days, as long as it notifies the consumer of the reason for the additional time needed to complete the request.
- Complying with the request to delete by:
- “Permanently and completely erasing the personal information on its existing systems with the exception of archived or back-up systems.
- Deidentifying the personal information.
- Aggregating the consumer information.”
- Informing the consumer it will maintain a record of the request as required by Section 999.317(b) of the regulations.
- In cases when the business denies the request:
- Informing the consumer it will not comply with the request and describing the basis for the denial.
- Deleting personal information of the consumer not subject to the exception.
- Not using the consumer’s personal information for any purpose other than provided for by that exception.
Right to no retaliation
Another important consumer right, the “right of no retaliation” encoded within the CCPA/CPRA Section 1798.125, prohibits businesses from discriminating against consumers for exercising “any of the consumer’s rights under this title” — such as requests to know, requests to delete or requests to correct information. Section 1798.125(a)(1) provides several examples of such discriminatory actions, such as denying goods or services to a consumer, charging different prices for a good/service, or providing a different level or quality of goods/services, unless that difference is “reasonably related to the value provided to the business by the consumer’s data.”
The CPRA also explicitly adds a statement in Section 1798.125(a)(3) explaining “offering loyalty, rewards, premium features, discounts, or club card programs” is not prohibited. Yet, the CPRA also establishes that, after a consumer has refused to provide opt-in consent for a financial incentive program, the business must wait for at least 12 months before requesting opt-in consent from that consumer again.
Through amendments made to the CCPA in October 2019 and in the text of the CPRA ballot initiative, the right to no retaliation applies not only to “consumers,” but to employees, applicants and independent contractors, as well. Section 1798.125(a)(1)(E) prohibits “[r]etaliating against an employee, applicant for employment, or independent contractor … for exercising their rights under this title.” While these groups do not enjoy the broad suite of consumer rights provided by the CCPA/CPRA, there are two privacy protections that continue to apply to them: (1) the right to be notified at collection; and (2) having “reasonable security” maintained for certain types of personal information, underpinned by a private right of action permitted for individuals affected by a data breach caused by a business’s negligence in this regard.
Children’s privacy
The first of the eight consumer rights that the CPRA enshrines within its purpose and intent is that “Consumers should know who is collecting their personal information and that of their children ….” Regarding the responsibilities of businesses, the text of the ballot initiative further lays out “Businesses should be held accountable when they violate consumers' privacy rights, and the penalties should be higher when the violation affects children.” The higher priority given to children’s privacy within the CPRA should signal to businesses that process the personal information of minors that enforcement in this area will be consequential.
Particularly, the CPRA has strengthened two opt-in rights for minors. According to Section 1798.135(c)(5), after a consumer under 16 years of age has declined to provide their consent to sell or share their personal information, a business must either wait for another 12 months or wait until the consumer turns 16 before requesting their opt-in consent again.
The CPRA has also tripled the fines for the collection and selling of children’s private information. Section 1798.155 on administrative enforcement specifies that a business, service provider or contractor who violates the title may be subject to a fine of up to $2,500 per violation, or $7,500 for violations involving the personal information of consumers whom the business, service provider or contractor “has actual knowledge is under 16 years of age.”
Conclusion
Businesses that have built a CCPA-compliant program will have to make modifications to bring their compliance into alignment with the new requirements introduced by the CPRA. With the July 1, 2022, deadline set for the California Privacy Protection Agency to adopt final regulations, all eyes will be on the new regulator to see how the CPRA’s protection for the key privacy rights to delete, no retaliation and children’s privacy will be spelled out.
Photo by Vital Sinkevich on Unsplash
