Do I Have to Dig Through Archives Each Time I Get an Access Request?
The CCPA contains several references to the obligation of a business to, in response to an access request, provide the “specific pieces of personal information” that it has collected about a California resident.1 Each of those sections is modified by California Civil Code Section 1798.130(a)(2), which states that “the disclosure” required by a business in response to an access request “shall cover the 12-month period preceding the business’s receipt of the verifiable consumer request . . . .”2 The statute reiterates that access is limited to a 12-month lookback in California Civil Code Section 1798.130(a)(3)(B) by stating that access requests that seek information about a business’s collection practices (as opposed to requests that seek the specific pieces of information held by the business) are similarly limited to “the preceding 12 months.”3
The CPRA amended the CCPA to require that the California Privacy Protection Agency adopt a regulation that establishes a standard by which a business could consider whether a request for information beyond the 12-month time period would be impossible or involve a “disproportionate effort.”4 Once the regulation is finalized, a consumer will be permitted to “request that the business disclose [specific personal information] beyond the 12-month period . . . .” 5 However, even when the regulation goes into effect (presumably in 2023), a business will still not be required to search for or produce personal information that was collected prior to Jan. 1, 2022.6
1 Cal. Civ. Codes 1798.100(a), 100(c), 110(b) (October 2020); Cal. Civ. Code 1798.110(a)(5).
2 Cal. Civ. Code 1798.130(a)(2) (Ocober 2020) (emphasis added).
3 Cal. Civ. Code 1798.130(a)(3)(B).
4 Cal. Civ. Code 1798.185(a)(9).
5 Cal. Civ. Code 1798.130(a)(2)(B).
6 Cal. Civ. Code 1798.130(a)(2)(B).