0

In Google's CCPA report, it claims that users can request data deletion via this link. However, the link provides no way to submit a request, and Google claims that there is no Google-wide support email address to contact. Is this allowed?

It explains why there were fewer than 500 CCPA requests to Google last year.

The link provides various piecemeal ways to delete specific data, but no way to submit a CCPA request.

1
  • I do not know enough to answer but from here it seems not "How do I submit my right to delete? Businesses must designate at least two methods for you to submit your request—for example, a toll-free number, email address, website form, or hard copy form."
    – User65535
    May 26, 2022 at 21:51

1 Answer 1

1

Yes, But ...

Under Section 1798.105 a covered business must honor erasure requests unless an exception applies. Under 1798.130 a business must provide an email address for this purpose if it operates just online, and if it has physical operations must provide at least two methods, including a telephone number.

However, under Section 1798.155 only the Attorney General of California may enforce these sections, there is no right of private action (private suit). Damage payments go to the state, not to the consumer.

Statute Text

Section 1798.105 of the CCPA provides in relevant part:

(a) |FAQs| A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.

(b) |FAQs| A business that collects personal information about consumers shall disclose, pursuant to Section 1798.130, the consumer’s rights to request the deletion of the consumer’s personal information.

(c) |FAQs| A business that receives a verifiable consumer request from a consumer to delete the consumer’s personal information pursuant to subdivision (a) of this section shall delete the consumer’s personal information from its records and direct any service providers to delete the consumer’s personal information from their records.

Section 1798.130 provides in relevant part:

(a) |FAQs| In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125, a business shall in a form that is reasonably accessible to consumers:

(1) Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115.

(2) Disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business’ duty to disclose and deliver the information within 45 days of receipt of the consumer’s request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. ...

...

(5) Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers’ privacy rights, or if the business does not maintain those policies, on its Internet Web site, and update that information at least once every 12 months:

(5) (A) A description of a consumer’s rights pursuant to Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125 and one or more designated methods for submitting requests.

(5) (B) For purposes of subdivision (c) of Section 1798.110, a list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected.

(5) (C) For purposes of paragraphs (1) and (2) of subdivision (c) of Section 1798.115, two separate lists:

(5) (C) (i) A list of the categories of personal information it has sold about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information sold, or if the business has not sold consumers’ personal information in the preceding 12 months, the business shall disclose that fact.

(5) (C) (ii) A list of the categories of personal information it has disclosed about consumers for a business purpose in the preceding 12 months by reference to the enumerated category in subdivision (c) that most closely describe the personal information disclosed, or if the business has not disclosed consumers’ personal information for a business purpose in the preceding 12 months, the business shall disclose that fact.

(6) Ensure that all individuals responsible for handling consumer inquiries about the business’ privacy practices or the business’ compliance with this title are informed of all requirements in Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125, and this section, and how to direct consumers to exercise their rights under those sections.

Section 1798.135 provides in relevant part:

(1) A business that is required to comply with Section 1798.120 shall, in a form that is reasonably accessible to consumers:

(1) (1) Provide a clear and conspicuous link on the business’s Internet homepage, titled “Do Not Sell My Personal Information,” to an Internet Web page that enables a consumer, or a person authorized by the consumer, to opt-out of the sale of the consumer’s personal information. A business shall not require a consumer to create an account in order to direct the business not to sell the consumer’s personal information.

(1) (2) Include a description of a consumer’s rights pursuant to Section 1798.120, along with a separate link to the “Do Not Sell My Personal Information” Internet Web page in:

(1) (2) (1) Its online privacy policy or policies if the business has an online privacy policy or policies.

(1) (2) (2) Any California-specific description of consumers’ privacy rights.

(1) (3) Ensure that all individuals responsible for handling consumer inquiries about the business’s privacy practices or the business’s compliance with this title are informed of all requirements in Section 1798.120 and this section and how to direct consumers to exercise their rights under those sections.

(1) (4) For consumers who exercise their right to opt-out of the sale of their personal information, refrain from selling personal information collected by the business about the consumer.

Section 1798.155 provides in relevant part:

(1) Any business or third party may seek the opinion of the Attorney General for guidance on how to comply with the provisions of this title.

(2) A business shall be in violation of this title if it fails to cure any alleged violation within 30 days after being notified of alleged noncompliance. Any business, service provider, or other person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation, which shall be assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General. The civil penalties provided for in this section shall be exclusively assessed and recovered in a civil action brought in the name of the people of the State of California by the Attorney General.

(3) Any civil penalty assessed for a violation of this title, and the proceeds of any settlement of an action brought pursuant to subdivision (b), shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160 with the intent to fully offset any costs incurred by the state courts and the Attorney General in connection with this title.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .