What Does the Act Require?
The CCPA provides consumers with four basic rights relating to their personal information:
- The Right to Know
At least two methods for a consumer to request that the company identify the personal information in its possession must be provided, including, at a minimum, a toll-free number and a link on the company web site. Such a request will need to be fulfilled by the company without charge and within 45 days after receipt of the request (with the possibility of additional time where reasonably necessary and requested).
- The Right to Opt Out
Companies that provide consumer personal information to third parties must enable consumers to “opt out” of having her/his information transferred. The opt-out/opt-in requirements are different for consumers under 16. In short, companies may not sell personal information of consumers age 13 to 16 without express “opt in,” and for consumers under age 13, the company may not sell her/his personal information without “opt in” from the consumer’s parent or guardian.
- The Right to Control and Be Forgotten
As noted above, consumers must be able to request the deletion of their personal information. This latter right to be forgotten, however, is not a blanket right and has limitation. Personal information need not be deleted, even after a request for such deletion by a consumer, when the information is, among other things, required to comply with a legal obligation or applicable laws (e.g., tax laws).
Note that where a company has a need to hold personal information, it may only hold and use that data for that specific purpose. If, for example, the company needs to hold the data for evidence of a tax-deductible donation, it may not be used to provide marketing materials to the donor or any other purpose outside of storage for legal compliance.
- The Right to Exercise Privacy Rights Without Prejudice
Companies may not discriminate against consumers who exercise their rights under the CCPA. That is, a company may not deny customers services, provide different goods or services, or charge customers different prices depending on whether they opt-out or otherwise take advantage of their rights under the CCPA. That said, the law nonetheless permits loyalty programs and other financial incentives that benefit those who don’t opt out.
What to Do to Get Ready?
January is coming. While the CCPA will not be directly applicable to many nonprofit organizations, each organization should be determining applicability and, in any event, considering the evolving privacy principles. Organizations should be discussing the issues with stakeholders within the company, primarily those interested in collecting and using the information (usually the marketing and donor relations departments) and those that control the technical collection of data (IT). It is important that both stakeholders provide input and understand the issues as it is common for systems to collect information that, for example, marketers were not actually looking to collect.