Flashback to a week ago. What was your business doing on July 1, 2021? Were you aware that the California Consumer Privacy Act (“CCPA”) imposed a deadline on businesses that buy, receive, sell and/or share for commercial purposes the personal information of 10 million or more California residents in a calendar year to report certain metrics in either their privacy policy or elsewhere online (with a link to their privacy policy). If you didn’t know that, or didn’t act on this in time, your current grade in CCPA Class might be standing at an “F.” Don’t have a privacy policy? That’s another issue.
By July 1, 2021, required businesses must publish metrics for each of the following categories of requests, the right to: (1) know; (2) delete; and (3) if applicable, opt out of sale:
- Total requests received
- Total requests complied with in whole
- Total requests complied with in part
- Total requests denied
- Average number of days (median or mean) within which the business substantively responded to requests
- Optional: Requests denied in whole or in part because the request was not verifiable, was not made by a consumer, called for information exempt from disclosure, or was denied on other grounds
The reporting obligations relate to the previous calendar year (2020). A reporting business may disclose statistics as to all individuals, as opposed to only consumers, but must explain such in its privacy policy or notice and have consumer specific reporting statistics available for inspection by the California Attorney General. A reporting business may, but is not required, to choose to also identify the number of requests denied because the request was not verified, not made by a consumer, called for information exempt from disclosure, or was denied on other grounds.
Covered businesses must maintain business records for a minimum of 24 months. All businesses, regardless of the public reporting thresholds, are responsible for informing persons responsible for handling privacy inquiries of CCPA compliance of all the requirements and how to direct consumers on how to exercise their rights. A documented training program would meet this requirement.
If you have not posted your metrics…post them as soon as possible. Since the metrics must be publicly posted, many are watching—regulators, consumers and privacy activists, let alone the opportunistic legal practitioners looking to target and sue non-complying businesses. The metrics may be sensitive (i.e., based on volumes of requests or denials) and businesses must publish and prepare for feedback and inquiry, as well as for their next posting.
California is only one of a handful of states (i.e., Virginia, Nevada) that have passed consumer data privacy legislation. With no federal legislation providing a uniform set of rules, businesses must monitor state consumer data privacy law developments and calendar upcoming deadlines.
For more information or assistance with reviewing data privacy for your business, please contact the Data Privacy & Cybersecurity Group.
Leech Tishman’s Facebook Page: https://www.facebook.com/leechtishman
Leech Tishman’s Twitter: https://twitter.com/LeechTishman
Leech Tishman’s Company Page on LinkedIn: https://www.linkedin.com/company/leech-tishman
Leech Tishman Fuscaldo & Lampl is a full-service law firm dedicated to assisting individuals, businesses, and institutions. Leech Tishman offers legal services in business restructuring & insolvency, corporate matters, employment & labor, estates & trusts, intellectual property, litigation & alternative dispute resolution, and real estate. In addition, the firm offers a wide range of legal services to clients in the aviation & aerospace, cannabis, construction, energy & natural resources, healthcare, and hospitality industries. Headquartered in Pittsburgh, PA, Leech Tishman also has offices in Chicago, Los Angeles, New York, Philadelphia, Sarasota, and Wilmington, DE.