This week marks two months since the California Consumer Privacy Act went into effect. Although the California Attorney General won’t begin enforcing the law until July 1, 2020, consumers have been permitted to submit requests to “know” or “delete” to covered businesses since January 1.
By now many covered businesses may have already received one or more requests from consumers attempting to exercise their CCPA rights. Under the law and proposed draft regulations, which were updated last month but have not been finalized, businesses that receive consumer requests have a limited number of days to respond.
The updated proposed regulations now specify that businesses that receive requests to know or delete must:
- Confirm receipt of the request to know or delete within 10 business days and provide information to the consumer about how the request will be processed along with a description of the verification process; and
- Respond to the request within 45 calendar days (or within 90 calendar days if notice and explanation for the delay is provided to the consumer).
Under the updated draft regulations, businesses that are selling consumer data have 15 business days to comply with the opt-out request.
The proposed draft regulations contain several other numerical requirements relating to records retention, notices and other disclosures. For additional information, see our CCPA By The Numbers chart, which we’ve updated to take into account the updated draft regulations as updated on February 10, 2020.
For more information please contact Mike Nitardy or any attorney in Frost Brown Todd’s Privacy & Data Security practice group. View all of our CCPA updates here.