Consumer privacy requests: deletion request records and request submission methods.

Plain English Breakdown

The candidate statement was overly broad in its claim that the bill expands consumer rights, as it does not introduce new rights but rather clarifies and specifies existing ones.

Consumer Privacy Requests: Deletion Records and Request Submission Methods

This law requires businesses to keep records of consumer requests to delete personal information and provides online methods for submitting such requests.

What This Bill Does

• Expands the right for consumers to request deletion of any personal information a business has collected about them.
• Allows businesses to retain a record of deletion requests if they did not get the information directly from the consumer, but only enough data needed to ensure the information stays deleted and is not used elsewhere.
• Requires businesses that operate exclusively online to provide an email address for submitting personal information requests.
• Also requires these businesses to offer an online method like a web form or portal for consumers to submit their requests.

Who It Names or Affects

• Consumers who want their personal information deleted by businesses.
• Businesses that collect and manage consumer data, especially those operating exclusively online.

Terms To Know

California Consumer Privacy Act (CCPA)

A law in California that gives consumers rights over their personal information collected by businesses.

California Privacy Rights Act (CPRA)

An initiative approved by voters to update and expand the CCPA, providing more protections for consumer data privacy.

Limits and Unknowns

• The bill does not specify when it will take effect.
• It only applies to businesses operating under California law.

Official Summary Text

SB 923, as amended, Becker.
Consumer privacy requests: deletion request records and request submission methods.
Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants to a consumer various rights with respect to personal information that is collected by a business. Among those rights, the CCPA includes the right to request that a business delete personal information that the business has collected from the consumer.
This bill would expand that right to include requesting the deletion of any personal information that the business has collected about the consumer. If the business did not obtain the personal information from the consumer, the bill would allow the business to retain a record of the deletion request and the minimum data necessary to ensure the consumer’s personal information remains deleted from its records and is not being used for any other purpose.
Existing law generally
requires businesses to make certain methods of communication available for consumers to submit personal information requests, including requests for deletion and correction. If a business operates exclusively online and has a direct relationship with the consumer from whom it collects personal information, existing law requires the business to provide consumers an email address for submitting personal information requests.
This bill would also require that business to make an online method, such as a web form or online portal, available to consumers for submitting personal information requests.
Existing law, the California Privacy Rights Act of 2020, an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.
This bill would declare that its provisions further the purposes and intent
of the California Privacy Rights Act of 2020.

Current Bill Text

Download Bill PDF