Skip Repeated Content

Are the verification requirements for access and deletion requests the same under the CCPA as they are under the GDPR?

July 21, 2020

No.

Both the CCPA and the GDPR provide individuals with a right to request access to their personal information and a right to request the deletion of their personal information.1 As a result, businesses that field rights requests are required to ensure that the requestor is indeed the individual he or she is claiming to be. The failure to properly verify an individual, and the subsequent unauthorized disclosure, can trigger data breach provisions under both laws.

While the GDPR provides high-level guidance on how to verify the identity of a requestor, the CCPA and the accompanying Proposed Regulations are more specific in their requirements. 2 Below is a comparison of the requirements for verifying the identity of a requestor under the GDPR and under the CCPA.

GDPR

CCPA

General Rules:

  • There are no specific requirements for the verification of a requestor.
  • If a business fails to properly verify the identity of a requestor, and ultimately discloses a consumer’s personal information to a third party without the consumer’s authorization, this will trigger the GDPR’s data breach provisions.
  • If there are doubts concerning the identity of an individual, the controller may request additional information.3
  • The controller must use all reasonable measures to verify the identity of a data subject who requests access to their information.4
  • A business must establish procedures for verifying the identity of a requestor. This implies that the procedures must (or should) be documented and complied with.

 

General Rules:

  • If a business fails to properly verify the identity of a requestor, and ultimately discloses a consumer’s personal information to a third party without the consumer’s authorization, this may or may not trigger the CCPA’s data breach provisions.
  • A business shall avoid requesting new information for verification unless it is necessary to complete the verification.5
  • Any additional information collected for the purposes of verification may only be used to verify the individual.6
  • A business must establish, document, and comply with a reasonable method for the verification of requests.7
  • A business cannot require the consumer to pay a fee for the verification of their identity. This includes requiring a consumer to provide a notarized affidavit (unless the business compensates the consumer for the cost of notarization).8
  •  If the consumer maintains an account, the business may verify their identity through that account using the business’ standard verification measures.9

Access:

  • If a specific information-access request is denied, the business must evaluate the request as if it were a category-access request.10
  • A business must verify individuals who submit category-level access request to a reasonable degree of certainty, which may include matching at least two data points.11
  • A business must verify individuals who submit specific-information access requests to a reasonably high degree of certainty, which may include matching at least three pieces of personal information.12

Opt-Out:

  • A request to opt-out does not need to be verifiable.13

Deletion:

  • A business must verify individuals who submit deletion request to a reasonably high degree of certainty, which may include matching at least three pieces of personal information.14

 

For more information and resources about the CCPA visit http://www.CCPA-info.com.


This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

1. Cal. Civil Code 1798.100(a); 1798.105(a); 1798.120(a); GDPR Art. 15; GDPR Art. 17.

2. On October 11, 2019, the Office of the California Attorney General proposed regulations to implement the CCPA. The Proposed Regulations largely add to the CCPA’s verification requirements.

3. GDPR Art. 12 (6)

4. GDPR, Recital 64

5. CCPA, Proposed Regulation 999.323(c)

6. Cal. Civil Code 1798.130(a)(7)

7. CCPA, Proposed Regulation 999.323(a)

8. CCPA, Proposed Regulation 999.323(d)

9. CCPA, Proposed Regulation 999.324(a)

10. CCPA, Proposed Regulation 999.313(c)(1)

11. CCPA, Proposed Regulation 999.325(b)

12. CCPA, Proposed Regulation 999.325(c)

13. CCPA, Proposed Regulation 999.315(h)

14. CCPA, Proposed Regulation 999.325(d)

This document provides a general summary and is for information/educational purposes only. It is not intended to be comprehensive, nor does it constitute legal advice. Specific legal advice should always be sought before taking or refraining from taking any action.