California has enacted several laws to protect consumer privacy with one of the most significant being the California Consumer Privacy Act (CCPA) which was expanded by the California Privacy Rights Act (CPRA). These laws grant consumers various rights regarding their personal data, including, but not necessarily limited to, the right to request the deletion of their personal information. Here’s how these rights apply to deleting personal information from third-party websites:
Key Consumer Rights Under CCPA/CPRA
1. Right to Request Deletion (Under CCPA/CPRA)
- Scope: California residents have the right to request that businesses delete the personal information they have collected about them. This includes data collected both directly and indirectly through online activities.
- Obligations of Businesses: Upon receiving a verifiable deletion request, businesses must delete the consumer’s personal information from their records and instruct any third parties with whom they have shared the data to do the same.
2. Right to Know What Information Is Collected: Before deleting their data, consumers can request to know what specific information a business has collected about them, how it is used, and whether it has been shared with third parties.
3. Exceptions to Deletion Rights: Certain types of information may be exempt from deletion requests. For instance, data necessary to complete a transaction, detect security incidents, comply with legal obligations, or for internal uses that align with consumer expectations may not be deleted.
4. Right to Opt-Out of Data Selling: Consumers can opt-out of the sale of their personal information to third parties. This is important because it prevents the spread of their data across more entities, reducing the need for multiple deletion requests.
Steps for Consumers to Delete Their Data
1. Identify the Business: Determine which business collected your data and whether it has shared it with third parties.
2. Submit a Deletion Request: Use the business’s online tools or contact methods (as required by CCPA/CPRA) to submit a deletion request. Businesses are required to provide at least two methods for consumers to make such requests.
3. Monitor/Confirm Response: The business must respond within 45 days. They may need to confirm your identity before proceeding with deletion.
4. Monitor/Confirm Deletion: Request that the business confirm deletion from third-party websites and service providers.
Federal and Other State Laws
While the CCPA/CPRA are the most comprehensive, other states are beginning to implement similar laws, and there are sector-specific regulations at the federal level. For example:
- Children’s Online Privacy Protection Act (COPPA): Requires websites to allow parents to delete PII collected from children under 13.
- General Data Protection Regulation (GDPR) (for EU residents): Provides robust deletion rights, often referred to as the “right to be forgotten.”
There are other federal statutes such as the Health Insurance Portability and Accountability Act (HIPAA), Fair Credit Reporting Act (FCRA), and Gramm-Leach-Bliley Act (GLBA) which provide some form of data protection guidelines. However, at the federal level, the right to delete personally identifiable information from third-party websites is limited and sector-specific. Consumers seeking broader deletion rights often rely on state laws or specific federal regulations that apply to sensitive data categories like children’s information, health data, or financial records.
Challenges and Enforcement
Despite these rights, consumers may face challenges, particularly in verifying that third-party deletions are completed. The California Privacy Protection Agency (CPPA) enforces compliance, allowing consumers to file complaints if they believe their rights have been violated. California consumers have strong legal rights to control their personal information, including requesting deletion from third-party websites. By understanding and exercising these rights, consumers can protect their privacy more effectively. You may contact our law firm by visiting www.atrizadeh.com for more information.