Can specific information be needed for verification in CCPA?

Question

If a site is registering users with name display , email and password (I am not reffering to stackexchange . ) The name is available for public display . The site provides access to account when people provide access to email and their password . Lets say an user loses a password or email . For password it is ok . For email if the user loses does the site need to provide access to account if user can write the name and password ? It is under the CCPA California . The reason I am asking is than combination of name and password is forgable copyable . I mean any user can guess the password and the combination may or may not be unique . Example to clarify : A user signs up with name "a" email a.a.a.a@a.a and password aaaaaaaaaa . A person furnishes name and password . The site given has only one account with name "a" and password aaaaaaaaaa . However can they say as name is public user must furnish email . Is it legal under CCPA California ?

Answer 1

CCPA section 1798.130 subsection (a) (2) (A) says:

The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business’s duty to disclose and deliver the information, to correct inaccurate personal information, or to delete personal information within 45 days of receipt of the consumer’s request. The time period to provide the required information, to correct inaccurate personal information, or to delete personal information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period.

In many other places the CCPA refers to a "verifiable consumer request". It does not specify how a bullishness must verify the request, other than using "reasonable methods". It indicates that a business shall:

To identify the consumer, associate the information provided by the consumer in the verifiable consumer request to any personal information previously collected by the business about the consumer.

The CCPA does not say what information that may or must be. It does not mandate that a business be able to validate any possible request. It does say (in section 1798.130.subsection (a) (B) (2) ) that:

The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request. If the consumer maintains an account with the business, the business may require the consumer to submit the request through that account.

Thje CCPA does not mandate providing any password recovery or account recovery mechanism for consumers who have forgotten a password or user ID. As a business may require "reasonable authentication" it could require a stronger password than "aaaaaaa". But if a consumer can supply info sufficient to reasonably match with previously collected info and verify that the requester is the same person, it must comply with the request, whether it provides password recovery or not.

The details on how a business identifies consumers, how it verifies requests, and how it manages accounts are left to the business. But such practices must be "reasonable". If challenged, a court would decide whether any particular practice is reasonable. I do not know of any court cases yet dealing with such issues.