California

The California Consumer Privacy Act of 2018 (CCPA), a state law which aims to protect California consumers from security breaches by giving them a lot of control over what businesses may do with their data. The CCPA includes a groundbreaking provision that gives California consumers the “right to deletion” of their data, essentially giving them a right to be forgotten. The California right to deletion affords less protection than the right to be forgotten of the GDPR and shows how the U.S. Constitution and federal law limit California’s version of the right.

Section 1798.105 (a) of the CCPA provides that “[a] consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.” Under 1798.105 (b) and (c), businesses that collect personal information about consumers must inform consumers of their rights to request the deletion of their personal information, delete the consumer’s personal information from their records if so requested, and direct any service providers to delete the consumer’s personal information from their records too. their personal information if so requested. There are, however, some broad exceptions. Notably, a business or service provider is not required to delete personal information if that information is needed to “[e]xercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.” 1798.105 (d)(4).¹

The CCPA and the GDPR give individuals to the right to be forgotten for different reasons. The CCPA is designed to protect consumers. It was written and passed largely in response to Cambridge Analytica’s deceptive practices to harvest and sell tens of millions of social media users’ personal data. The roots of the GDPR are the 1950 European Convention on Human Rights and earlier European values of honor and insult. if we accept Whitman’s characterization of European privacy law as “an aspect of dignity” whose fundamental values are respect and honor, and American privacy law as “an aspect of liberty” whose fundamental values are property and free speech, it is not surprising that the CCPA looks very different from the GDPR. The good news is that no matter what the original purpose of the CCPA was, it can be used to order the erasure of records in certain circumstances.

The California Consumer Privacy Act (CCPA) does not explicitly exempt convicted felons from its provisions. However, certain types of personal information are exempt from the CCPA’s requirements, such as information already protected by other federal or state laws, such as the Gramm-Leach-Bliley Act (GLBA) or the Health Insurance Portability and Accountability Act (HIPAA). Thus, data of formerly convicted individuals related to the conviction may be erasable if the record of the conviction contains identifying information making it personal information. Under the CCPA, personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked (directly or indirectly) with a particular consumer or household.

2020 California Proposition 24

California continues to lead other states in privacy law. The California Privacy Rights Act of 2020 (CPRA), also known as Proposition 24, is a California ballot proposition that amends the CCPA. It was approved by a majority of voters after appearing on the ballot for the general election on November 3, 2020. This proposition expands California’s consumer privacy law and builds upon the CCPA. Other states have a good model to follow in California lawmakers’ work.

Footnotes