May 20, 2022

Volume XII, Number 140

Advertisement
Advertisement

May 19, 2022

Subscribe to Latest Legal News and Analysis

May 18, 2022

Subscribe to Latest Legal News and Analysis

May 17, 2022

Subscribe to Latest Legal News and Analysis

Do I Have to Dig Through Archives Each Time I Get an Access Request?

The CCPA contains several references to the obligation of a business to, in response to an access request, provide the “specific pieces of personal information” that it has collected about a California resident.1 Each of those sections is modified by California Civil Code Section 1798.130(a)(2), which states that “the disclosure” required by a business in response to an access request “shall cover the 12-month period preceding the business’s receipt of the verifiable consumer request . . . .”2 The statute reiterates that access is limited to a 12-month lookback in California Civil Code Section 1798.130(a)(3)(B) by stating that access requests that seek information about a business’s collection practices (as opposed to requests that seek the specific pieces of information held by the business) are similarly limited to “the preceding 12 months.”3

The CPRA amended the CCPA to require that the California Privacy Protection Agency adopt a regulation that establishes a standard by which a business could consider whether a request for information beyond the 12-month time period would be impossible or involve a “disproportionate effort.”4 Once the regulation is finalized, a consumer will be permitted to “request that the business disclose [specific personal information] beyond the 12-month period . . . .” 5 However, even when the regulation goes into effect (presumably in 2023), a business will still not be required to search for or produce personal information that was collected prior to Jan. 1, 2022.6


1 Cal. Civ. Codes 1798.100(a), 100(c), 110(b) (October 2020); Cal. Civ. Code 1798.110(a)(5).

Cal. Civ. Code 1798.130(a)(2) (Ocober 2020) (emphasis added).

3 Cal. Civ. Code 1798.130(a)(3)(B).

4 Cal. Civ. Code 1798.185(a)(9).

Cal. Civ. Code 1798.130(a)(2)(B).

6 Cal. Civ. Code 1798.130(a)(2)(B).

©2022 Greenberg Traurig, LLP. All rights reserved. National Law Review, Volume XI, Number 43
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

David A. Zetoony Privacy Attorney Greenberg Traurig
Shareholder

David Zetoony, Co-Chair of the firm's U.S. Data, Privacy and Cybersecurity Practice, focuses on helping businesses navigate data privacy and cyber security laws from a practical standpoint. David has helped hundreds of companies establish and maintain ongoing privacy and security programs, and he has defended corporate privacy and security practices in investigations initiated by the Federal Trade Commission, and other data privacy and security regulatory agencies around the world, as well as in class action litigation. 

David receives regular recognitions from clients and peers for...

303.685.7425
Advertisement
Advertisement
Advertisement