Passed by a legislature intent on providing Californian consumers with “an effective way to control their personal information,” the California Consumer Privacy Act aims to ensure various individual rights. The CCPA provides consumers with the right to erasure, ability to object to the sale of their personal information, and "right to opt out" and "right to opt in," all of which come with significant operational impacts. The CCPA also gives Californians the ability to object to the sale of their personal information. In addition to a "right to opt out," the CCPA enshrines a "right to opt in" that applies specifically to consumers under the age of 16, requiring businesses to obtain their affirmative consent — or the affirmative consent of a parent or guardian — before selling any of these consumers' personal information. The law also protects Californians' right "to equal service and price, even if they exercise their privacy rights."
This fourth installment in a five-part series describes the obligations imposed on businesses by the erasure, objection to sale, and nondiscrimination rights contained in the law. Prior installments in this series addressed the law’s scope; its transparency obligations; and tips for responding to consumers’ personal information access requests.
Right of erasure
The CCPA’s Section 1798.105 grants consumers the right to request erasure of “any personal information about the consumer which the business has collected from the consumer.” It requires businesses to fulfill such requests — and to direct “any service providers” to do the same — within 45 days of receiving a “verified request” or “verifiable request” from the consumer. A rights-disclosure provision also requires businesses that collect personal information about consumers to disclose to those consumers their rights to request the deletion of their personal information. Lastly, it carves out various exceptions to this right of erasure. If certain conditions are met, businesses may not be required to delete a customer’s personal information upon receiving an erasure request.
Perhaps the most broadly worded exceptions concern “internal uses” of personal information. These exceptions, for example, will allow businesses to continue to use a consumer’s personal information that has been the subject of an erasure request “internally, in a lawful manner that is compatible with the context in which the consumer provided the information.” A similar exception is carved out for “solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.” These two exceptions will likely need to be fleshed out before the law's coming into effect in January 2020.
Another exception allows businesses that engage in “public or peer-reviewed … research in the public interest” to ignore erasure requests “when the businesses’ deletion of the information is likely to render impossible or seriously impair the achievement of such research.” However, two further conditions must be met before this exception may apply: First, the business must adhere to “all other applicable ethics and privacy laws,” and, second, the consumer must have provided "informed consent" for the conduct of the research.
Businesses are also not required to delete information “if it is necessary” to:
- Complete the transaction for which it was collected.
- Provide a good or service the consumer has requested.
- Perform a contract between the business and the consumer.
- Detect security incidents.
- Protect against “malicious, deceptive, fraudulent, or illegal” activities.
- Prosecute people responsible for “malicious, deceptive, fraudulent, or illegal” activities.
- “Debug to identify and repair errors that impair existing intended functionality.”
- Ensure the exercise of free speech by another customer.
- Ensure the company’s exercise of “another right provided for by law.”
- Comply with a legal obligation, in particular, those of the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
Objection to sale
The CCPA provides for two related rights regarding the sale of personal information: a "right to opt out" in Section 1798.120 (a-c) and a “right to opt in” in Section 1798.120(d). The first authorizes consumers to opt out of the sale of their personal information by a business. That is, a consumer may direct a business not to sell its personal information. Moreover, businesses that sell personal information must provide consumers with "explicit notice" that they may sell their personal information to a third party as well as “an opportunity to exercise the right to opt out” before any selling occurs. A consumer may exercise this right “at any time,” and may also authorize another person to opt out on their behalf. Businesses that are directed by a consumer or their designee not to sell their personal information may not do so “unless the consumer subsequently provides express authorization” for such sale. Once a consumer has opted out of the sale of their personal information, a business must wait at least 12 months before requesting that the consumer authorize its sale. Finally, any information the consumer provides in connection with their opt-out request must be used “solely for the purposes of complying” with that request.
The right to opt in, meanwhile, requires businesses to obtain affirmative authorization from consumers between the ages of 13 and 16, and from the parent or guardian of consumers under the age of 13, before selling any of their personal information. The CCPA thus prohibits businesses from selling the personal information of a consumer they have “actual knowledge” is between the ages of 13 and 16, unless the consumer has "affirmatively authorized" the sale. Moreover, businesses are prohibited from selling the information of a consumer under the age of 13 unless they have obtained affirmative authorization from the consumer's parent or guardian. This section of the law also makes it clear that a business will be considered to have had actual knowledge of a consumer's age if it “willfully disregards” their age. Operationally, an important question is whether failing to ask for or require a consumer to provide proof of age at the point of sale constitutes willful disregard of it.
The “do not sell” button
To meet their obligations regarding the opt-in/-out rights enshrined in the CCPA within Section 1798.135, businesses must provide a “reasonably accessible” and “clear and conspicuous link” on their homepage, titled “Do Not Sell My Personal Information.” This link must enable a consumer to opt out of the sale of their personal information but must not require them to create an account in order to do so. The link must also describe the consumer's rights pursuant to this section and must be contained in its online privacy policy or policies, as well as any “California-specific description of consumers' privacy rights” that it maintains.
Additionally, the homepage containing this link to the opt-out request need not be made available to the general public, but only needs to be available to California consumers. That is, to comply with these obligations, businesses may maintain “a separate and additional homepage that is dedicated to California consumers and that includes the required links and text,” as long as they have taken “reasonable steps” to ensure California consumers are directed to it.
Lastly, this section of the CCPA places obligations on businesses to ensure that “individuals responsible for handling consumer inquiries about the business’s privacy practices or the business’s compliance with this title,” for example, data protection officers, are informed of the relevant requirements and know how to direct consumers to exercise their rights.
Nondiscrimination
The CCPA also contains a non-discrimination provision in Section 1798.125 that relates to the prices and quality of goods and services a business provides to its consumers. To protect consumers who exercise their privacy rights under this law, the provision prohibits businesses from: (1) denying them goods or services; (2) charging them a different (i.e., higher) price; (3) providing them goods or services of a different (i.e., lower) quality; or (4) suggesting that (2) or (3) will occur. As the law states in a “complex and seemingly self-contradictory” exception, however, businesses may charge different prices or provide a different level or quality of goods or services to consumers that exercise their privacy rights “if the difference is reasonably related to value provided by the consumer's data.”
As explained in the law, the bill thus “would authorize businesses to offer financial incentives for collection of personal information.” Financial incentives would include, for example, “payments to consumers as compensation … for the collection … sale … or the deletion of personal information.” Businesses that do offer financial incentives for the collection of consumers' personal information must also notify consumers of these offers, and consumers must give businesses their “prior opt-in consent” to enter the program, which they may revoke “at any time.” Lastly, these financial incentives and the practices surrounding them must not be “unjust, unreasonable, coercive, or usurious in nature.”
In operational terms, the CCPA may prompt some businesses to specify the value of the personal data they collect from each consumer. This opens up numerous intriguing questions: How much is an email address worth? What about a phone number or home address? What is the relative value of other types of personal information that are mentioned in Section 1798.140 the law, such as a person's “preferences, characteristics, psychological trends, … predispositions, behavior, attitudes, intelligence, abilities, and aptitudes”? If businesses do decide to offer financial incentives to customers to collect their personal information, it will be interesting to see how and by what means they price this information.
By Makaristos [Public domain], from Wikimedia Commons.
