In order for an entity to be considered a business, and hence regulated by the CCPA, it must satisfy at least one of three thresholds. One such threshold is whether the business has “annual gross revenue in excess of twenty-five million dollars.”[1]
The CCPA does not specify whether the gross revenue threshold refers to
The CCPA requires that a service provider agree to three substantive restrictions involving the retention, use, and disclosure of personal information. The CPRA ostensibly expands upon the three substantive contractual restrictions by referring to nine additional provisions that should be included within a service provider agreement. The following chart compares the substantive service provider contractual
It depends.
The CPRA ostensibly expanded the three substantive contractual restrictions identified in the CCPA by referring to nine additional provisions that should be included within a service provider agreement by January 1, 2023. Many of the new requirements, however, may be redundant of, or subsumed within, contractual provisions that were put in place to
It depends.
The CPRA ostensibly expanded the three substantive contractual restrictions identified in the CCPA by referring to nine additional provisions that should be included within a service provider agreement by January 1, 2023. Many of the new requirements, however, may be redundant of, or subsumed within, contractual provisions that were put in place to
No.
The CPRA created a new sub-category of personal information that it labels “sensitive personal information.” [1] The sub-category is comprised of twenty specific data fields which include, among other things, the religious beliefs, racial origin, precise geolocation, and sexual orientation of a consumer. Beginning on January 1, 2023, consumers will have the right to
The CCPA did not explicitly label any data type as being more, or less, “sensitive” than another, although it did confer special data security-related rights on a subset of data types.
The CPRA created a new sub-category of personal information that it labels “sensitive personal information.” [1] The sub-category is comprised of twenty specific data
No.
The regulations implementing the CCPA require that in-scope businesses must provide two or more designated methods of submitting requests to opt-out, including an interactive form accessible via a clear and conspicuous link titled “Do Not Sell My Personal Information,” on the business’s website or mobile application.[1]
In addition to the “DNSMPI” link noted
No.
The European GDPR permits a company to retain personal data for “no longer than is necessary for the purposes for which the personal data are processed.”[1] As a result, if a company no longer needs information to accomplish a specific purpose, the company is, theoretically, required to delete that information. The requirement that
No.
The European GDPR permits a company to collect only that information which is “adequate, relevant and limited to what is necessary in relation to the purposes” for which the information is to be processed.”[1] As a result, a company arguably is not permitted to collect personal data that is not “necessary” for a
No.
The right of rectification refers to the ability of a person to request that a company fix any inaccuracies in the personal information that it holds about them. While the right of rectification is one of the core tenants of European data privacy law, it is not included within the CCPA.
Unlike the CCPA,