How Do I Exercise My Right to Know?
The California Consumer Privacy Act of 2018 (CCPA) grants four (4) new privacy rights—one of which is the Right to Know.
There are two (2) types of requests that you can make as a consumer when you exercise your Right to Know under the CCPA:
-
Request to Know categories
-
Request to Know specific information
If you make a Request to Know categories, a business must respond to your request with the following general information:
-
The categories of personal information the business has collected about you, within the last 12 months
-
The categories of sources from which the business has collected your personal information from
-
The business or commercial purpose for which the business has collected your personal information for
-
The categories of third parties with whom the business discloses each category of personal information to
-
The categories of personal information the business has sold about you, within the last 12 months
-
The categories of third parties to whom the business has sold your personal information to, within the last 12 months
In the event that a business has neither disclosed nor sold your information, they must respond to your request with a statement indicating that the business has neither disclosed nor sold your personal information.
On the other hand, if you make a Request to Know specific information, a business must respond to your request with the actual pieces of personal information they have collected about you (e.g. your name, your email address, your telephone number, etc.)—provided that this information is not considered sensitive information (e.g. bank account number, credit card information, etc.). Additionally, when specific pieces of personal information are not reasonably searchable or accessible by a business, that business is not obligated to provide that information even when requested.
When Should I Expect a Response to my Request to Know?
After you have submitted your Request to Know to a business—either for categories, or for specific information—you should expect a response within ten (10) business days. This first response would acknowledge the receipt of your request, and, in some cases, may also request additional information from you, in order to verify your identity.
In total, you should expect your Request to Know to be processed and fulfilled within 45 calendar days from the date of your request. Once per request, however, a business may extend this deadline for another 45 days, provided that the business has clearly notified you of this extension and the reason for it. If a business extends the deadline, your Request to Know may take up to 90 days to be processed and fulfilled.
Why Are They Asking for My Personal Information?
Businesses may ask you for additional information in order to process your Request to Know. This information is used by the business to confirm that you are a California resident and to ensure that you are, in fact, the person making the request.
The identity verification process is especially important when businesses are answering your Request to Know specific information, as the release of specific information to the wrong individual would create a whole new privacy risk. Consequently, if a business is unable to verify your identity, they may lawfully deny your Request to Know.
Related: What Are My Rights Under the CCPA? / Can A Business Deny My Privacy Request?