1

I am learning the basics about CCPA, hoping to create a directory of organizations (and the people of those organizations), in a community-driven fashion like Wikipedia. From what I understand now, those in California have the right to request removal of their data from the system. Say our system allows the community to add information about individuals and businesses, which might include one particular customer. What are the laws relating to their right to request removal of such data, given that it is a free public resource of publicly available data (their name, social media accounts, etc.), and the "Exceptions to California Consumer’s Right to Delete" of which one is "Free Speech", and there are a few others. I don't know much about privacy laws, but what are the laws in relation to this sort of situation? Could it be said that it is free speech to share someones name, what about their phone number or address? I would like to learn more about privacy laws in this regard.

3
  • That is correct, only publicly available information. Aug 19 at 20:36
  • Yes this would be a for-profit business with > 50k CA residents. Aug 19 at 20:51
  • 1
    Thanks. That's helpful. Since you've answered my questions, I've deleted them to reduce clutter. If I have time, I will write up an answer. I think there's a bit more to say. PS Have you followed the debates on online doxing, etc? Legally, a directory is a benign form of doxing, of sharing someone's information without their permission.
    – Just a guy
    Aug 19 at 21:13
2

-CCPA section 1798.105 provides in paragraph (d) (4) that:

(d) A business or a service provider shall not be required to comply with a consumer’s request to delete the consumer’s personal information if it is necessary for the business or service provider to maintain the consumer’s personal information in order to:

...

(4) Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.

The California Attorney General (AG), whose office is charged with enforcing the CCPA, has published regulations clarifying the Act, but so, far none of them have dealt with this provision. I can find no case in which an action b y the AG's office, or a court case, has interpreted this provision.

There are many online guides to the CCPA, or FAQs or advice on how to comply, but most either do not mention 105 (4)(d) at all, or merely quote it, offering no further guidance.

The page CCPA Deletion Exempotions" by SixFifty, reads:

In Europe, the ‘right to be forgotten’ requires search engines like Google to remove certain results from search requests. A European who was arrested for a crime and then released, for example, might request that Google not direct people searching his name to old news reports of his arrest. Taking a different approach to tensions between privacy and speech, the CCPA protects data against deletion in order to allow the exercise of free speech, ensure the rights of other consumers to exercise free speech, or allow the “exercise of another right provided for by law.”

While many privacy advocates have encouraged states or the federal government to adopt the ‘right to be forgotten’ or broader deletion rights, there are concerns that such deletion could infringe on other fundamental rights. Clearly, California’s legislature is signaling that deletion of personal information is secondary to free speech when it weighs those rights against one another. Freedom of the press is likely to qualify as another “right provided for by law” that would negate a deletion request from a consumer under the CCPA.

This suggests that such an online directory, compiled as a public benefit, might be exempt as an exercise of free speech. But it is far from authoritative.

One should remember that the CCPA does not create a private right of action for the Request to Delete (or Request to Know) procedure. Only the California AG is empowered to enforce these rights. Consumers may file complaints with the office of the AG, but it is up to that office to decide whether to take action or not. Moreover, if the AG elects to take such action, it must give the business at least 30 days to cure any failure to act on the right to delete. If the business complies within 30 days after getting a notice from the AG's office, there is no penalty.

A person or organization operating such a directory service could rely on section 105(d)(4) as a basis to refuse requests, until and unless notified by teh AG that this is not valid. Or such a person could request the AG to clarify this section of the act, possibly by issuing a further regulation or issuing an opinion letter. The AG might or might not respond.

A person or organization operating such a directory service could ask a California lawyer to issue an opinion letter as to whether the operator is required to delete such info under such circumstances, having regard to 105(d)(4). Such a letter would establish a reasonable basis for action, and the good faith of the operator, even if the AG later took a different view. A lawyer would no doubt charge a fee for doing the research and writing such a letter.

2
  • When you say, "the CCPA does not create a private right of action for the Request to Delete (or Request to Know) procedure," do you mean a consumer can't directly request the business to delete information? Or do you mean that consumers can't sue the business for violating CCPA?
    – Just a guy
    Aug 19 at 16:32
  • @Just The second. In legal terms a "private right of action" is a right to sue someone. The CCPA creates a right to request deletion, or to request info on file, but if the business does not respond satisfactorily, only the AG can sue or get an injunction. There is a right to sue over a data breech. Aug 19 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.