Extracts :

Extract :

"However, a business that has received direction from a consumer not to sell or share their personal information or, in the case of a minor consumer's personal information has not received consent to sell or share the minor consumer's personal information, will be prohibited from selling or sharing the consumer's personal information after its receipt of the consumer's direction, unless the consumer subsequently provides consent for the sale or sharing of their personal information (§1798.120(d) of the CCPA as amended). In relation to sensitive personal information, where a business receives a request from a consumer not to use or disclose their sensitive personal information, except where exceptions apply, is prohibited from using or disclosing the consumer's sensitive personal information for any other purpose after receipt of the request. The business can only use or disclose the consumer's sensitive personal information if they subsequently provide consent for the use or disclosure of their sensitive personal information for additional purposes (§1798.121(b) of the CCPA as amended). The revised CCPA Regulations provide more specific principles for designing and implementing requirements associated with obtaining consumer consent. These principles include (§7004(a) of the revised CCPA Regulations): the method is easy to understand; consumers having symmetry in choice; avoid language or interactive elements that are confusing; avoid choice architecture that impairs or interferes with the consumer's ability to make a choice; and Must be easy to execute. The revised CCPA Regulations further highlight that a method that does not comply with the above will be considered a dark pattern, and any agreement obtained through the use of dark patterns will not constitute valid consent (§7004(b) of the revised CCPA Regulations)."

2023

Reference :

California Data protection overview | DataGuidance

Updated DataGuidance reports

Extracts :

Extract :

"In general, CCPA privacy policies are required to include a description of consumer rights, methods for exercising those rights, contact information, and the date the policy was last updated. Also be sure to specify that the privacy policy is limited in scope and applies only to California residents. CCPA privacy policies should include: A description of California consumer privacy rights, including: The right to know (request disclosure of) personal information collected or sold. The right to deletion of personal information collected from the consumer. The right to nondiscriminatory treatment for exercising any rights. The right to opt out of the sale of personal information (if applicable). The right to opt in to the sale of personal information of minors (if applicable). An explanation of designated methods for exercising consumer rights. Instructions for submitting a verifiable consumer request. A description of the process used to verify consumer requests. Instructions on how an authorized agent can make a request on a consumer’s behalf. A statement of whether the business sells personal information and, if it does, notice of the right to opt out or a “Do Not Sell My Personal Information” link. Categories of personal information collected about consumers in the past 12 months. Categories of personal information disclosed for a business purpose or sold to third parties in the preceding 12 months. Categories of sources from which personal information is collected. Categories of third parties to whom personal information was disclosed or sold. The business purpose or commercial purpose for collecting or selling personal information. A statement of whether the business has actual knowledge that it sells the personal information of minors. Contact information for questions or concerns about the business’ privacy policy or practices. The date the CCPA privacy policy was last updated."

2023

Reference :

What Is a CCPA Privacy Policy? Do You Need One?

Information on California's privacy notice | Bloomberg

Link to reference

Extracts :

Extract :

"In general, CCPA privacy policies are required to include a description of consumer rights, methods for exercising those rights, contact information, and the date the policy was last updated. Also be sure to specify that the privacy policy is limited in scope and applies only to California residents. CCPA privacy policies should include: A description of California consumer privacy rights, including: The right to know (request disclosure of) personal information collected or sold. The right to deletion of personal information collected from the consumer. The right to nondiscriminatory treatment for exercising any rights. The right to opt out of the sale of personal information (if applicable). The right to opt in to the sale of personal information of minors (if applicable). An explanation of designated methods for exercising consumer rights. Instructions for submitting a verifiable consumer request. A description of the process used to verify consumer requests. Instructions on how an authorized agent can make a request on a consumer’s behalf. A statement of whether the business sells personal information and, if it does, notice of the right to opt out or a “Do Not Sell My Personal Information” link. Categories of personal information collected about consumers in the past 12 months. Categories of personal information disclosed for a business purpose or sold to third parties in the preceding 12 months. Categories of sources from which personal information is collected. Categories of third parties to whom personal information was disclosed or sold. The business purpose or commercial purpose for collecting or selling personal information. A statement of whether the business has actual knowledge that it sells the personal information of minors. Contact information for questions or concerns about the business’ privacy policy or practices. The date the CCPA privacy policy was last updated."

2023

Reference :

What Is a CCPA Privacy Policy? Do You Need One?

Information on California's privacy notice | Bloomberg

Link to reference

Extracts :

Extract :

"In general, CCPA privacy policies are required to include a description of consumer rights, methods for exercising those rights, contact information, and the date the policy was last updated. Also be sure to specify that the privacy policy is limited in scope and applies only to California residents. CCPA privacy policies should include: A description of California consumer privacy rights, including: The right to know (request disclosure of) personal information collected or sold. The right to deletion of personal information collected from the consumer. The right to nondiscriminatory treatment for exercising any rights. The right to opt out of the sale of personal information (if applicable). The right to opt in to the sale of personal information of minors (if applicable). An explanation of designated methods for exercising consumer rights. Instructions for submitting a verifiable consumer request. A description of the process used to verify consumer requests. Instructions on how an authorized agent can make a request on a consumer’s behalf. A statement of whether the business sells personal information and, if it does, notice of the right to opt out or a “Do Not Sell My Personal Information” link. Categories of personal information collected about consumers in the past 12 months. Categories of personal information disclosed for a business purpose or sold to third parties in the preceding 12 months. Categories of sources from which personal information is collected. Categories of third parties to whom personal information was disclosed or sold. The business purpose or commercial purpose for collecting or selling personal information. A statement of whether the business has actual knowledge that it sells the personal information of minors. Contact information for questions or concerns about the business’ privacy policy or practices. The date the CCPA privacy policy was last updated."

2023

Reference :

What Is a CCPA Privacy Policy? Do You Need One?

Information on California's privacy notice | Bloomberg

Link to reference

Extract :

Extracts :

Extract :

"In general, CCPA privacy policies are required to include a description of consumer rights, methods for exercising those rights, contact information, and the date the policy was last updated. Also be sure to specify that the privacy policy is limited in scope and applies only to California residents. CCPA privacy policies should include: A description of California consumer privacy rights, including: The right to know (request disclosure of) personal information collected or sold. The right to deletion of personal information collected from the consumer. The right to nondiscriminatory treatment for exercising any rights. The right to opt out of the sale of personal information (if applicable). The right to opt in to the sale of personal information of minors (if applicable). An explanation of designated methods for exercising consumer rights. Instructions for submitting a verifiable consumer request. A description of the process used to verify consumer requests. Instructions on how an authorized agent can make a request on a consumer’s behalf. A statement of whether the business sells personal information and, if it does, notice of the right to opt out or a “Do Not Sell My Personal Information” link. Categories of personal information collected about consumers in the past 12 months. Categories of personal information disclosed for a business purpose or sold to third parties in the preceding 12 months. Categories of sources from which personal information is collected. Categories of third parties to whom personal information was disclosed or sold. The business purpose or commercial purpose for collecting or selling personal information. A statement of whether the business has actual knowledge that it sells the personal information of minors. Contact information for questions or concerns about the business’ privacy policy or practices. The date the CCPA privacy policy was last updated."

2023

Reference :

What Is a CCPA Privacy Policy? Do You Need One?

Information on California's privacy notice | Bloomberg

Link to reference

Extract :

Extracts :

Extract :

"In general, CCPA privacy policies are required to include a description of consumer rights, methods for exercising those rights, contact information, and the date the policy was last updated. Also be sure to specify that the privacy policy is limited in scope and applies only to California residents. CCPA privacy policies should include: A description of California consumer privacy rights, including: The right to know (request disclosure of) personal information collected or sold. The right to deletion of personal information collected from the consumer. The right to nondiscriminatory treatment for exercising any rights. The right to opt out of the sale of personal information (if applicable). The right to opt in to the sale of personal information of minors (if applicable). An explanation of designated methods for exercising consumer rights. Instructions for submitting a verifiable consumer request. A description of the process used to verify consumer requests. Instructions on how an authorized agent can make a request on a consumer’s behalf. A statement of whether the business sells personal information and, if it does, notice of the right to opt out or a “Do Not Sell My Personal Information” link. Categories of personal information collected about consumers in the past 12 months. Categories of personal information disclosed for a business purpose or sold to third parties in the preceding 12 months. Categories of sources from which personal information is collected. Categories of third parties to whom personal information was disclosed or sold. The business purpose or commercial purpose for collecting or selling personal information. A statement of whether the business has actual knowledge that it sells the personal information of minors. Contact information for questions or concerns about the business’ privacy policy or practices. The date the CCPA privacy policy was last updated."

2023

Reference :

What Is a CCPA Privacy Policy? Do You Need One?

Information on California's privacy notice | Bloomberg

Link to reference

Extract :

Extracts :

Extract :

"In general, CCPA privacy policies are required to include a description of consumer rights, methods for exercising those rights, contact information, and the date the policy was last updated. Also be sure to specify that the privacy policy is limited in scope and applies only to California residents. CCPA privacy policies should include: A description of California consumer privacy rights, including: The right to know (request disclosure of) personal information collected or sold. The right to deletion of personal information collected from the consumer. The right to nondiscriminatory treatment for exercising any rights. The right to opt out of the sale of personal information (if applicable). The right to opt in to the sale of personal information of minors (if applicable). An explanation of designated methods for exercising consumer rights. Instructions for submitting a verifiable consumer request. A description of the process used to verify consumer requests. Instructions on how an authorized agent can make a request on a consumer’s behalf. A statement of whether the business sells personal information and, if it does, notice of the right to opt out or a “Do Not Sell My Personal Information” link. Categories of personal information collected about consumers in the past 12 months. Categories of personal information disclosed for a business purpose or sold to third parties in the preceding 12 months. Categories of sources from which personal information is collected. Categories of third parties to whom personal information was disclosed or sold. The business purpose or commercial purpose for collecting or selling personal information. A statement of whether the business has actual knowledge that it sells the personal information of minors. Contact information for questions or concerns about the business’ privacy policy or practices. The date the CCPA privacy policy was last updated."

2023

Reference :

What Is a CCPA Privacy Policy? Do You Need One?

Information on California's privacy notice | Bloomberg

Link to reference

Extract :

Extracts :

Extract :

"In general, CCPA privacy policies are required to include a description of consumer rights, methods for exercising those rights, contact information, and the date the policy was last updated. Also be sure to specify that the privacy policy is limited in scope and applies only to California residents. CCPA privacy policies should include: A description of California consumer privacy rights, including: The right to know (request disclosure of) personal information collected or sold. The right to deletion of personal information collected from the consumer. The right to nondiscriminatory treatment for exercising any rights. The right to opt out of the sale of personal information (if applicable). The right to opt in to the sale of personal information of minors (if applicable). An explanation of designated methods for exercising consumer rights. Instructions for submitting a verifiable consumer request. A description of the process used to verify consumer requests. Instructions on how an authorized agent can make a request on a consumer’s behalf. A statement of whether the business sells personal information and, if it does, notice of the right to opt out or a “Do Not Sell My Personal Information” link. Categories of personal information collected about consumers in the past 12 months. Categories of personal information disclosed for a business purpose or sold to third parties in the preceding 12 months. Categories of sources from which personal information is collected. Categories of third parties to whom personal information was disclosed or sold. The business purpose or commercial purpose for collecting or selling personal information. A statement of whether the business has actual knowledge that it sells the personal information of minors. Contact information for questions or concerns about the business’ privacy policy or practices. The date the CCPA privacy policy was last updated."

2023

Reference :

What Is a CCPA Privacy Policy? Do You Need One?

Information on California's privacy notice | Bloomberg

Link to reference

Extract :

🇺🇸 US-California

Data subject classification

Citizens outside their jurisdiction are considered as data subjects : No

Persons within their jurisdiction are considered as data subjects : No

Legal entities are considered as data subjects : No

Data controller definition and responsibilities

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : No

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Differentiation between how data controller and data processor are defined : Yes

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : No

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": biometric data : Yes

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": financial data : Yes

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : No

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : Yes

Definition of personal data that are "special" or "sensitive": political opinions : No

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : Yes

Definition of personal data that are "special" or "sensitive": geo-location data : Yes

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject : No

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : No

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : No

Potential legal bases for processing personal data: the personal data is necessary for a public interest : No

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : No

Enforcement and penalties

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) : 6990.53

Consideration of turnover rates for penalties? : No

Provision of criminal penalties - fines : No

Subject private remedies - presence of individual personal actions? : Yes

Subject private remedies - representative actions? : No

Subject private remedies - class actions? : Yes

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Provision of criminal penalties - imprisonment : No

Data processing and security controls

Audit or supervise Data Processors :

Requirement of a DPIA : Yes

Ensuring encryption/pseudonymisation as a security control : No

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : No

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Rights of data subjects

Right to object data use or/opt out : Yes

Right to data portability : Yes

Right against automated decision making : Yes

Right to be informed : Yes

Consent required for processing children's data : Yes

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : Yes

Right to restrict data processing : Yes

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : Yes

Legal basis for international data transfer: approved standard contractual clauses : No

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : Yes

Legal basis for international data transfer: binding corporate rules : No

Data localisation requirements: retention of personal data in local jurisdiction : No

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : Yes

Legal basis for international data transfer: Convention 108 : No

Data localisation requirements: national security laws : No

Legal basis for international data transfer: APEC CBPRs : Yes

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : No

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : No

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : No

Data protection officer (DPO) requirements

Consulting the supervisory authority (DPA) before data processing : No

Mandatory appointment of a DPO : No

Requirement of professional/legal qualification/expert knowledge for DPO : No

Clear DPO role specification : No

Group appointments: a group of undertakings to appoint a single DPO : No