As a direct marketing agency headquartered in Orange County, California, Database Marketing Group has always made data privacy and security a top priority. With the passing of the California Consumer Privacy Act (CCPA), we have been working to maintain and ensure our processes and systems are up-to-date with data and information security laws. Although consumer data allows us to build more effective marketing campaigns, we take this responsibility seriously. Here is some information regarding California residents’ rights under the CCPA:
CA Residents have the right to:
…know what personal information is being collected about them.
…know whether their personal information has been sold or disclosed, and to whom.
…say no to the sale of personal information.
…view or access their personal information that is available to data companies.
…equal service and price, even if they exercise their privacy rights.
As more and more businesses utilize consumer data to make more informed decisions about marketing strategy and consumer engagement initiatives, it has become their responsibility to be transparent about what types of data they are collecting and how it is being used. Now that CA residents can make requests about their data, businesses must prepare to be able to handle and service these requests in a timely manner.
Businesses must be ready to handle two different types of requests and provide CA residents with at least two or more designated methods for submitting requests. The two different types of requests are as follows:
- Disclosure requests – what categories of personal information has been collected and their sources, the business or commercial purpose for collecting or selling personal information, the categories of third parties with whom the business shares personal information, and the specific pieces of personal information it has collected about the consumer.
- Deletion requests – the CA resident has the right to request that business delete their consumer data upon verifying the user’s identity and confirming that they are who they say they are. Upon such requests, businesses are required to delete the consumer data (there are exceptions) and direct any third party service providers to delete the consumer’s personal information from their records as well.
Key highlights businesses can take away from the CCPA title are as follows:
- Requests must be reasonably verified that the person making the request matches or is on behalf of the consumer in the requested consumer data file.
- The rights in this title cannot be waived away through contract or an agreement (i.e. terms and agreement).
- Deidentified or aggregated data based on information that cannot be reidentified does not fall under this title. For this to be true, the company must take steps to make information unidentifiable and not be able to reidentify the information back to an individual consumer or identifying marker.
Be sure to continually check back on our blog to stay up-to-date with the latest marketing insights as well as compliance initiatives as many states have legislature regarding consumer data rights.