What can I do if my CCPA request is being ignored?

Question

I’m a California resident and requested to inspect my data with a certain tech company using their online form. That is now over 3 months ago. Two weeks ago, I followed up with them by email. So far I have not received any acknowledgment or confirmation that my request has been received. I read somewhere that companies have 45 days to respond to such a request but that they can also get an extension. In any event, I’d like to know for how much longer I should wait and what I can do if my request is not responded to?

Answer 1

Overview of the CCPA

The CCPA constitutes California Civil Code TITLE 1.81.5. California Consumer Privacy Act of 2018 (sections 1798.100 - 1798.199.100)

(Note: the online version gives both original and amended versions of many of the code sections. Be careful to refer to the current version, which is usually the last version of the section provided.)

Additional The CALIFORNIA CONSUMER PRIVACY ACT REGULATIONS (also known as Title II, Division 1, Chapter 20) are regulations issued by the California Attorney General, as required byn the CCPA, implementing and interpreting the CCPA. They include sections 999.300 et seq.

Section 1798.110 allows a consumer to request that the business provide information about its collection of personal information, as well as a copy of the information actually collected. The information must be disclosed "upon receipt of a verifiable consumer request from the consumer."

Section 1798.105 allows a consumer to request deletion of information, and Section 1798.106 allows a consumer to request correction of incorrect information. Sections 1798.115 and 1798.120 grant additional rights when the business shares or sells information.

Section 1798.130 specifies that a business must respond to requests from consumers within 45 days. Actual fulfillment of the request can be delayed fro a further 45 days, provided that the consumer is given notice within the first 45 days.

A business must provide reasonable methods to submit a request. For an online-only business, an email address is enough. Otherwise an 800 phone number must be one of the ways. Consumers must use one of the methods specified by the business, and must provide enough information for the request to be "verifiable". (But the business must respond to requests made by other methods.)

Additional Regulations section 999.308 (c) (1)08 (c) (1) b and 999.308 (c) (1) c say that a business must provide in its privacy policy instructions on how to submit a request for information (called a "request to know") with links to a an online form or portal for this purpose, and a description of the verification process.

Additional Regulations section 999.312 subsections (a), (b), and (c) indicate how the business may select the methods for a consumer to submit a request to know. 999.312 (e) says that when a consumer submits a request through some method other than one of the4 designated methods, or submits a request that is incomplete, the business must either treat it as having been proerply submitted, or inform the consumer how to correct or properly resubmit the request.

Additional Regulations section 999.313 say that a business must acknowledge the request within 10 days "and provide information about how the business will process the request."

Additional Regulations section 999.313 subsections (c) (1) and (c) (2) say that if the business cannot verify the identity of the consumer it may deny the request, but must respond informing the requestor that it could not verify his or her identity and also giving more general information.

Sections 1798.145 and 1798.146 list various exemptions and limitations on the obligations of a business. In particular, the CCPA does not apply to medical information covered by the Federal HIPAA law.

Under section 1798.150 a consumer whose information was improperly accessed and taken can sue for an amount between $100 and $750 per incident, or the amount of actual damages.

The CA Attorney General has issued detailed implementing regulations for various provisions of the CCPA. See link above

Under section 1798.155 a business can be fined up to $2,500 fore each violation of the CCPA, or up to $7,500 for each intentional violation with respect to consumers under 16. Only the California Privacy Protection Agency may enforce such fines.

Conclusions

A Consumer must make a request by one of the designated methods provided by a business, or it may be ignored. The business has to inform consumers about those methods. Email and telephone are likely methods, as is a form on the business's web site. The consumer must provide enough information that the business can verify that the request is valid. The business must inform requestors who use an improper method or did not supply sufficient identification information of how to correct or resubmit the request.

The business has 45 days to respond, and up to an additional 45 days to actually provide, correct, or delete the information, but only if the extra time is reasonably required. It must, however, acknowledge requests within 10 days.

If the business does not comply, the consumer cannot directly sue. Instead the consumer may complain to the California Privacy Protection Agency, which can (but need not) investigate, and may hold a hearing and impose a fine after such a hearing.

If there is an information breech a consumer can sue directly.

Specific Provisions

1798.110 Consumers’ Right to Know What Personal Information is Being Collected. Right to Access Personal Information

(a) A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer the following:

(a) (1) The categories of personal information it has collected about that consumer.

(a) (2) The categories of sources from which the personal information is collected.

(a) (3) The business or commercial purpose for collecting, selling, or sharing personal information.

(a) (4) The categories of third parties to whom the business discloses personal information.

(a) (5) The specific pieces of personal information it has collected about that consumer.

1798.130 Notice, Disclosure, Correction, and Deletion Requirements

(a) In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers:

(a) (1) (A) Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.

(a) (1) (B) If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.

(a) (2) Disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business’ duty to disclose and deliver the information within 45 days of receipt of the consumer’s request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure shall cover the 12-month period preceding the business’ receipt of the verifiable consumer request and shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request. If the consumer maintains an account with the business, the business may require the consumer to submit the request through that account.

...

(a) (5) Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers’ privacy rights, or if the business does not maintain those policies, on its internet website and update that information at least once every 12 months:

(a) (5) (A) A description of a consumer’s rights pursuant to Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125 and one or more designated methods for submitting requests.

(a) (5) (B) For purposes of subdivision (c) of Section 1798.110, a list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.

...

(b) A business is not obligated to provide the information required by Sections 1798.110 and 1798.115 to the same consumer more than twice in a 12-month period.

1798.150 Personal Information Security Breaches

(a) (1) Any consumer whose nonencrypted and nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, or whose email address in combination with a password or security question and answer that would permit access to the account is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action for any of the following:

(a) (1) (A) To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater. ...

(b) Actions pursuant to this section may be brought by a consumer if, prior to initiating any action against a business for statutory damages on an individual or class-wide basis, a consumer provides a business 30 days’ written notice identifying the specific provisions of this title the consumer alleges have been or are being violated. In the event a cure is possible, if within the 30 days the business actually cures the noticed violation and provides the consumer an express written statement that the violations have been cured and that no further violations shall occur, no action for individual statutory damages or class-wide statutory damages may be initiated against the business. ...

(c) The cause of action established by this section shall apply only to violations as defined in subdivision (a) and shall not be based on violations of any other section of this title. Nothing in this title shall be interpreted to serve as the basis for a private right of action under any other law.

1798.155. Administrative Enforcement

(a) Any business, service provider, contractor, or other person that violates this title shall be liable for an administrative fine of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation or violations involving the personal information of consumers whom the business, service provider, contractor, or other person has actual knowledge are under 16 years of age, as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185, in an administrative enforcement action brought by the California Privacy Protection Agency.

1798.192 Waiver

Any provision of a contract or agreement of any kind, including a representative action waiver, that purports to waive or limit in any way rights under this title, including, but not limited to, any right to a remedy or means of enforcement, shall be deemed contrary to public policy and shall be void and unenforceable. ...

Excerpts from the Regulations

§ 999.308 Privacy Policy. (a) Purpose and General Principles

(a) (1) The purpose of the privacy policy is to provide consumers with a comprehensive description of a business’s online and offline practices regarding the collection, use, disclosure, and sale of personal information and of the rights of consumers regarding their personal information

(b) The privacy policy shall be posted online through a conspicuous link using the word “privacy” on the business’s website homepage or on the download or landing page of a mobile application. ...

(c) The privacy policy shall include the following information: (c) (1) Right to Know About Personal Information Collected, Disclosed, or Sold.

a. Explanation that a consumer has the right to request that the business disclose what personal information it collects, uses, discloses, and sells.

b. Instructions for submitting a verifiable consumer request to know and links to an online request form or portal for making the request, if offered by the business.

c. General description of the process the business will use to verify the consumer request, including any information the consumer must provide.

d. Identification of the categories of personal information the business has collected about consumers in the preceding 12 months. The categories shall be described in a manner that provides consumers a meaningful understanding of the information being collected. ...

§ 999.312. Methods for Submitting Requests to Know and Requests to Delete.

(a) A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests to know. All other businesses shall provide two or more designated methods for submitting requests to know, including, at a minimum, a toll-free telephone number. Other acceptable methods for submitting these requests include, but are not limited to, a designated email address, a form submitted in person, and a form submitted through the mail.

(b) A business shall provide two or more designated methods for submitting requests to delete. Acceptable methods for submitting these requests include, but are not limited to, a toll-free phone number, a link or form available online through a business’s website, a designated email address, a form submitted in person, and a form submitted through the mail.

(c) A business shall consider the methods by which it primarily interacts with consumers when determining which methods to provide for submitting requests to know and requests to delete. If the business interacts with consumers in person, the business shall consider providing an in-person method such as a printed form the consumer can directly submit or send by mail, a tablet or computer portal that allows the consumer to complete and submit an online form, or a telephone with which the consumer can call the business’s toll-free number

...

(e) If a consumer submits a request in a manner that is not one of the designated methods of submission, or is deficient in some manner unrelated to the verification process, the business shall either:

(e) (1) Treat the request as if it had been submitted in accordance with the business’s designated manner, or

(e) (2) Provide the consumer with information on how to submit the request or remedy any deficiencies with the request, if applicable.

§ 999.313. Responding to Requests to Know and Requests to Delete.

(a) Upon receiving a request to know or a request to delete, a business shall confirm receipt of the request within 10 business days and provide information about how the business will process the request. The information provided shall describe in general the business’s verification process and when the consumer should expect a response, except in instances where the business has already granted or denied the request. The confirmation may be given in the same manner in which the request was received. For example, if the request is made over the phone, the confirmation may be given orally during the phone call.

(b) Businesses shall respond to requests to know and requests to delete within 45 calendar days. The 45-day period will begin on the day that the business receives the request, regardless of time required to verify the request. If the business cannot verify the consumer within the 45day time period, the business may deny the request. If necessary, businesses may take up to an additional 45 calendar days to respond to the consumer’s request, for a maximum total of 90 calendar days from the day the request is received, provided that the business provides the consumer with notice and an explanation of the reason that the business will take more than 45 days to respond to the request ...

(c) Responding to Requests to Know.

(c) (1) For requests that seek the disclosure of specific pieces of information about the consumer, if a business cannot verify the identity of the person making the request pursuant to the regulations set forth in Article 4, the business shall not disclose any specific pieces of personal information to the requestor and shall inform the requestor that it cannot verify their identity. If the request is denied in whole or in part, the business shall also evaluate the consumer’s request as if it is seeking the disclosure of categories of personal information about the consumer pursuant to subsection (c)(2).

(c) (2) For requests that seek the disclosure of categories of personal information about the consumer, if a business cannot verify the identity of the person making the request pursuant to the regulations set forth in Article 4, the business may deny the request to disclose the categories and other information requested and shall inform the requestor that it cannot verify their identity. If the request is denied in whole or in part, the business shall provide or direct the consumer to its general business practices regarding the collection, maintenance, and sale of personal information set forth in its privacy policy. ...

(c) (5) If a business denies a consumer’s verified request to know specific pieces of personal information, in whole or in part, because of a conflict with federal or state law, or an exception to the CCPA, the business shall inform the requestor and explain the basis for the denial, unless prohibited from doing so by law. If the request is denied only in part, the business shall disclose the other information sought by the consumer.