California's CCPA, as amended by the CPRA, covers qualifying businesses collecting personal consumer data and covered contractors or service providers. Notice, access, deletion, correction and opt-out rights sit with sensitive-data limits, security and records of verified requests.
TL;DR:
- Covered consumers can access, delete, correct and restrict specified uses of personal information.
- Qualifying businesses need notices and request processes, with distinct contractor and supplier roles.
- Financial-data exclusions do not automatically exempt every activity of a payment company.
Summary
Coverage follows the business and the information
The California Consumer Privacy Act applies to qualifying for-profit businesses that collect personal information about California residents and meet the statutory coverage conditions. The California Privacy Rights Act amended rather than replaced the CCPA. Its framework distinguishes businesses from service providers, contractors and other recipients of information. A company's role and the particular information or processing activity determine which requirements and exemptions are relevant.
Rights consumers can exercise
Covered consumers have rights to know about personal information, request deletion and correction and opt out of sale or sharing within the statutory framework. The law also provides a right to limit certain uses and disclosures of sensitive personal information. These rights are subject to their conditions and exceptions; they are not a statement that every request overrides all legal retention duties or that every transfer of data has the same legal character.
Notices and the handling of requests
Businesses must provide the required privacy information and processes through which consumers can exercise applicable rights. Identity verification is relevant to certain requests, while opt-out requests have their own requirements. The law also addresses discrimination for exercising rights and the contractual conditions attached to service-provider and contractor relationships. Operational handling of requests is therefore as important as the wording of a published privacy notice.
Payment data and the limits of exemptions
Payment businesses can process identity, contact, account and transaction information across several purposes and relationships. The CCPA contains exemptions for specified information governed by laws such as GLBA, but these should not be simplified into a universal exemption for every business offering a financial product. The information, activity and applicable legal provision need to be considered together. Enforcement responsibilities include the California Privacy Protection Agency and the Attorney General.
Keywords
- CCPA
- CPRA
- California privacy
- access rights
- deletion requests
- data correction
- sale opt-out
- sharing limits
- sensitive information
- financial exemptions