California Code of Regulations › Title 11 - Law › Division 6 - California Privacy Protection Agency › Chapter 1 - California Consumer Privacy Act Regulations › Article 5 - Verification of Requests › Section 7062 - Verification for Non-Accountholders

Current through Register 2024 Notice Reg. No. 28, July 12, 2024
(a) If a consumer does not have or cannot access a
				  password-protected account with a business, the business shall comply with this
				  section, in addition to section
				  7060.
(b) A business's compliance with a request to know
				  categories of personal information requires that the business verify the identity of
				  the consumer making the request to a reasonable degree of certainty. A reasonable
				  degree of certainty may include matching at least two data points provided by the
				  consumer with data points maintained by the business that it has determined to be
				  reliable for the purpose of verifying the consumer.
(c) A business's compliance with a request to know
				  specific pieces of personal information requires that the business verify the
				  identity of the consumer making the request to a reasonably high degree of
				  certainty. A reasonably high degree of certainty may include matching at least three
				  pieces of personal information provided by the consumer with personal information
				  maintained by the business that it has determined to be reliable for the purpose of
				  verifying the consumer together with a signed declaration under penalty of perjury
				  that the requestor is the consumer whose personal information is the subject of the
				  request. If a business uses this method for verification, the business shall
				  maintain all signed declarations as part of its record-keeping
				  obligations.
(d) A business's compliance
				  with a request to delete or a request to correct may require that the business
				  verify the identity of the consumer to a reasonable or reasonably high degree of
				  certainty depending on the sensitivity of the personal information and the risk of
				  harm to the consumer posed by unauthorized deletion or correction. For example, the
				  deletion of family photographs or the correction of contact information may require
				  a reasonably high degree of certainty, while the deletion of browsing history or
				  correction of marital status may require only a reasonable degree of certainty. A
				  business shall act in good faith when determining the appropriate standard to apply
				  when verifying the consumer in accordance with these regulations.
(e) Illustrative examples follow:
(1)
Example 1:
If a business
				  maintains personal information in a manner associated with a named actual person,
				  the business may verify the consumer by requiring the consumer to provide evidence
				  that matches the personal information maintained by the business. For example, if a
				  retailer maintains a record of purchases made by a consumer, the business may
				  require the consumer to identify items that they recently purchased from the store
				  or the dollar amount of their most recent purchase to verify their identity to a
				  reasonable degree of certainty.
(2)
Example 2:
If a business maintains personal information in a manner
				  that is not associated with a named actual person, the business may verify the
				  consumer by requiring the consumer to demonstrate that they are the sole consumer
				  associated with the personal information. For example, a business may have a mobile
				  application that collects personal information about the consumer but does not
				  require an account. The business may determine whether, based on the facts and
				  considering the factors set forth in section
				  7060, subsection (b)(3), it may
				  reasonably verify a consumer by asking them to provide information that only the
				  person who used the mobile application may know or by requiring the consumer to
				  respond to a notification sent to their device.