What You Need to Know about the California Consumer Privacy Act

The Law

In 2018, California strengthened the rights of individuals and their personally identifiable information (PII) by enacting the California Consumer Privacy Act (CCPA). This Act gave consumers more control of the personal information that businesses collect about them. Personal information is considered anything that identifies, relates to, or could reasonably be linked to an individual or their household, including name, social security number, email address, records of products purchased, internet browsing history, geographic data, fingerprints, and inferences from other information.

As a business leader, you must allow California consumers the right to:

1. Know the personal information collected about them.

• At the consumer’s request, you must identify information that you have collected about them, and if it was used, shared, or sold.
• You must designate at least two methods for consumers to submit a request for this information. One method must be a toll-free phone number and if you have a website, one method must be through the website.
• You have 45 calendar days to respond to a request for this information, with a possible 45-day extension.
• You must verify the identity of the person making the request, but you can only use the information for verification purposes.

2. Delete personal information collected from them.

• At the consumer’s request, you must delete personal information and tell their service providers to do the same.
• You must designate two methods for a consumer to request a deletion of their personal information.
• You have 45 calendar days to respond to a request to delete their personal information, with a possible 45-day extension.
• You must verify the identity of the person making the request, but you can only use the information for verification purposes.

3. Opt-out of the sale of their personal information.

• You must offer two or more methods for consumers to opt out of the sale of their personal information, and must wait 12 months before asking consumers to opt back in. Consumers may also opt-out by a user-enabled global privacy control, like the GPC.
• If you sell personal information, you are required to provide a clear and conspicuous “Do Not Sell My Personal Information” link on your website allowing consumers to submit an opt-out request.
• You cannot require consumers to create an account to submit a request.

4. Non-discrimination for exercising their CCPA rights.

• You cannot deny consumers goods or services, charge a different price, or provide a different level or quality of goods or services because they exercised their rights under the CCPA.
• Should information that you requested be denied during a transaction, you have the right to not provide goods or services should that information be required to do so.
• You can offer promotions, discounts, and other deals in exchange for collecting, keeping, or selling personal information.

The Mission

The goal of this law is to protect your customers from fraud due to PII breaches. As a legitimate and valuable business, you can help protect your customers by following all privacy laws, including the California Consumer Privacy Act. You can further protect your customers, employees, and company by safeguarding all collected sensitive information, especially anything that is discarded. This is more manageable when you partner with a reputable shredding company to ensure that any collected information that needs to be destroyed is done safely and securely.

Pacific Shredding fully understands the federal and state privacy laws related to information destruction. We follow strict rules and guidelines to be a NAID AAA Certified company, so you can be confident that we protect you, in order for you to protect your customers. If you do business in Stockton, Sacramento, Modesto, Fresno or Napa and Solano counties, give us a call at 800-685-9034 or complete the form on this page.