Are businesses required to offer the same methods for submitting DSR requests under the CCPA as they are under the GDPR?
Much like the GDPR, the CCPA gives consumers certain rights over their data. In particular, California residents have the right to request access to their personal information, the right to request the deletion of their personal information, and the right to opt out of the sale of their personal information.1
Businesses that are already GDPR-compliant will have pre-existing methods for fielding data subject requests, such as web portals, email addresses, or dedicated phone numbers. While these methods may be adequate, businesses should double check that all of the CCPA’s requirements are met. Whereas the GDPR has very few requirements governing submission methods, the requirements under the CCPA and Proposed Regulations are numerous.2
The end result is that if a business is GDPR compliant with respect to how data subjects are able to submit rights requests, it may not be CCPA compliant. In contrast, if a business is CCPA compliant with respect to how consumers are able to submit rights requests, it will almost certainly be GDPR compliant.
Below is a comparison of the requirements for methods to submit requests under the GDPR and under the CCPA.
For more information and resources about the CCPA visit http://www.CCPA-info.com.
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. Cal. Civil Code 1798.100(a); 1798.105(a); 1798.120(a).
2. On October 11, 2019, the Office of the California Attorney General proposed regulations to implement the CCPA. The Proposed Regulations largely add to the CCPA’s access and deletion request requirements.
3. GDPR, Recital 59
4. Cal. Civil Code 1798.130(a)(1)
5. Cal. Civil Code 1798.130(a)(1)
6. CCPA, Proposed Regulation 999.312(e)
7. Cal. Civil Code 1798.135(a)(1)
8. CCPA, Proposed Regulation 999.315(a)
9. CCPA, Proposed Regulation 999.315(a)
10. CCPA, Proposed Regulation 999.315(b)
11. CCPA, Proposed Regulation 999.315(d)
12. CCPA, Proposed Regulation 999.312(e)
13. CCPA, Proposed Regulation 999.312(b)
14. CCPA, Proposed Regulation 999.312(e)
This document provides a general summary and is for information/educational purposes only. It is not intended to be comprehensive, nor does it constitute legal advice. Specific legal advice should always be sought before taking or refraining from taking any action.