Source: https://teachprivacy.com/notable-changes-in-the-modified-draft-ccpa-regulation/
Timestamp: 2020-02-26 21:02:09
Document Index: 21829056

Matched Legal Cases: ['§ 999', '§ 999', '§ 999', '§ 999', '§ 999', '§ 999', '§ 999', '§ 999', '§ 999']

Notable Changes in the Modified Draft CCPA Regulation - TeachPrivacy
(2) Just-in-Time Notice
The regulation, at § 999.305(a)(4), include this example for using just-in-time notice:
Paul Schwartz and I propose a similar rule in our ALI Data Privacy Principles — we call it “heightened notice.”
(3) Notice to Employees Regarding Their Data
At § 999.305(e), the regulation provides:
(e) A business collecting employment-related information shall comply with the provisions of section 999.305 except with regard to the following:
(1) The notice at collection of employment-related information does not need to include the link or web address to the link titled “Do Not Sell My Personal Information” or “Do Not Sell My Info”.
(2) The notice at collection of employment-related information may include a link to, or paper copy of, a business’s privacy policies for job applicants, employees, or contractors in lieu of a link or web address to the business’s privacy policy for consumers.
(4) Weird Opt Out “Button”
There is a new confusing opt out “button” that’s not really a button but a toggle. From § 999.306(f):
(5) Notice of Financial Incentive Exception
Pursuant to § 999.307(a)(1):
A business that does not offer a financial incentive or price or service difference related to the disclosure, deletion, or sale of personal information is not required to provide a notice of financial incentive.
(6) Exception to Requirement of 2+ Methods for Submitting Requests to Know for Exclusively Online Businesses
The CCPA regulation, § 999.312(a), now contains a new exception to the requirement that businesses provide people with two or more methods for submitting requests to know:
A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests to know. All other businesses shall provide two or more designated methods for submitting requests to know, including, at a minimum, a toll-free telephone number. Other acceptable methods for submitting these requests include, but are not limited to, a designated email address, a form submitted in person, and a form submitted through the mail.
(7) Exceptions for Responding to a Request to Know
At § 999.313(c)(3), a new addition to the regulation states:
In responding to a request to know, a business is not required to search for personal information if all the following conditions are met:
(8) Addition of Biometric Information as Exclusion from Right to Know Disclosures
At § 999.313(c)(4), biometric data was added:
A business shall not at any time disclose in response to a request to know a consumer’s Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, or security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics.
(9) Easy Opt Out
The following provision was added at § 999.315(c):
A business’s methods for submitting requests to opt-out shall be easy for consumers to execute and shall require minimal steps to allow the consumer to opt-out. A business shall not utilize a method that is designed with the purpose or substantial effect of subverting or impairing a consumer’s decision to opt-out.
(10) Financial Incentives and Data Valuation
The regulation at § 999.336(b) adds the following restriction:
If a business is unable to calculate a good-faith estimate of the value of the consumer’s data or cannot show that the financial incentive or price or service difference is reasonably related to the value of the consumer’s data, that business shall not offer the financial incentive or price or service difference.
The regulation adds a number of examples. The following example captures best the concept that the regulations are trying to articulate:
I foresee that considerable attention will be given to data valuation – how to ascribe a value to particular pieces of personal data — so that businesses can justify the financial incentives they offer in exchange for people’s data. The regulation offers the following factors to be considered (most of these are from the original draft):
(1) The marginal value to the business of the sale, collection, or deletion of a consumer’s data;
(3) The aggregate value to the business of the sale, collection, or deletion of consumers’ data divided by the total number of consumers;
(8) Any other practical and reasonably reliable method of calculation used in good-faith.
Posted in California Privacy Law, CCPATagged CCPA regulation
A Terrifying New Dimension of RansomwareThe Myth of the Privacy Paradox