The deadline is quickly approaching for businesses to post their consumer request metrics under the California Consumer Privacy Act (CCPA) Regulations.
These reporting obligations, outlined in Section 999.317(g) of the CCPA Regulations, apply to any business that is subject to the CCPA and that knows or reasonably should know that it, alone or in combination, buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes the personal information of 10,000,000 or more California residents in a calendar year.
Businesses subject to the reporting obligations must disclose by July 1 of every calendar year, either in the Privacy Policy or elsewhere online with a link in their Privacy Policy, the following metrics for the previous calendar year:
- The number of requests to know that the business received, complied with in whole or in part, and denied;
- The number of requests to delete that the business received, complied with in whole or in part, and denied;
- The number of requests to opt-out that the business received, complied with in whole or in part, and denied; and
- The median or mean number of days within which the business substantively responded to requests to know, requests to delete, and requests to opt-out.
The first reporting deadline, applicable to calendar year 2020, is July 1, 2021.
If you have any questions concerning the material discussed in this client alert, please contact the member of our Data Privacy and Cybersecurity practice.
Back
