CCPA vs GDPR: Key Differences in Consumer Rights

[00:00:00]well welcome everybody to the ia PP web conference us privacy the California consumer privacy act in the GDP are brought to you today by one trust my name is Dave Cohen my peepees knowledge manager I'll be hosting the program today we're going to get started with the presentation in just a minute but before we do I wanted to cover a few details participating in today's program will automatically provide IEP certified privacy professionals who are the named registrants with one C PE credit everybody else who's listening in can apply for those credits through an easy-to-use online form on our website under the certification tab we also like to remind you that today's program is being recorded and will be provided free to registered attendees approximately 48 hours following a live event that's going to be posted on the IEP P website we encourage you to ask questions at any time during the program by typing them into the Q&A field that's just to the right of your PowerPoint window and we've reserved a question and answer period toward the end of the webinar so now on to our program and I'd like to briefly discuss what we're going to be covering today in a moment I'm going to be introducing today's panelists and then we're going to go over for you what the data subject requests are for the GD P R and the CCPA and then we're going to talk about importantly where they overlap and what are the differences and we're going to finish the program by talking about how you can begin to think about and actually implement operationalizing these data subject to requests we're gonna leave you with some takeaways and some other information about some upcoming events we're going to take some time to answer your questions as I mentioned a moment ago and then we'll wrap up the program so with that and without any further ado I would like to introduce today's panelists Andrew Clearwater is the director of privacy and one trust a fellow Manor right up here with me here in Portsmouth New Hampshire up in northern New England Andrew welcome to the program and key tell us a bit about your position down there at one trust in your background of course thanks Dave yes Andrew inter Clearwater director of privacy at one trust I'm an attorney if you ask an LLM in the global on technology I work with Benedict in our privacy program at one trust and I was previously a privacy officer in the health care space and I certain privacy policy through future of privacy forum and Harvard's Birkin better terrific thanks Andrew welcome to the panel and joining Andrea on the panel today but a dikhta bream is a privacy counsel of one trust coming today to us from their offices down in atlanta georgia and a deked welcome and can you tell us a bit about your professional background dance first holiday thank you and hello everyone so i'm privacy counsel at one trust so then you mentioned work closely with him i do handle on our privacy program and also i've been focusing on cgpa since they was passed and prior to being at one trust i worked at the future of privacy forum in DC as well and also at a firm in paris on different privacy and corporate issues wonderful welcome but addict and that's round out our panel today coming to us from another far corner of the united states out in los angeles Dominique Shelton Leipsic is a partner from the privacy and security practice and Perkins Korea out in LA and is also co-chair of the EdTech privacy and data management team Dominique it's great to have you with us in case Housel bit about your practice yeah well thank you Dave and I'm really excited to be on the panel with everyone as you said I'm a partner and Perkins to these privacy and data security group and I chair the firms ad tech privacy and data management group and these days been focusing a lot on data strategy and management for companies because there's so much going on with all of the evolving areas of law we're going to talk about CCPA that gdpr and then all these new other bills coming up been really working with clients to figure out a top-line compliance approach great thanks Dominique and with that now we've got a lot to cover today so let's go ahead and get started and Dominique is going to get us some going today so Dominique it's all yours thanks Dave so you know first we thought we just talked about data subject rights in the gdpr because it's sort of the basis for how we're going to compare the rights that are available in California so of course with jpr you've got a right to act that's an article 15 that the residents have they have the right to correct data and request that under Article 16 they can stay the subjects in the EU can also make the racial request but there are some specific limitations as to when the ratio requests are valid you know you can only bring them under certain circumstances and so it's very important to realize that a ratio requests are not just automatic and in the EU then subjects have the right to restrict the processing of the data they have a right of portability they have objection rights they have the ability to object to automated processing and even though it's not really stated as a right they do have I just put here the transparency obligation that companies have because other the GDP are they do need to have transparency with respect to their to consumer notice under article 13 so let me just move on here to just talk about the post GDP our landscape so as you guys you know probably heard right after GDP our went into effect on May 25th the data protection authorities are I guess supervisory authorities now throughout the EU were just daily with thousands of data subject right requests and and what the thousands of data subject rights claims that followed data subject rights requests that were sort of thrown on companies and so one of the things that has come up is that because the Data Protection Authority has been so busy in the EU many companies and there wasn't a real process that's been outlined in article 84 getting information to companies about the complaints that have been lodged against them with the Supervisory authorities it's only months later that many of the companies start getting coffee the complaints to see what had been actually lodged against them and with the Supervisory authorities this to you you know back up a little bit there's also in addition to the complaints that are coming in I'm going to talk to you about some specific claims that are being asserted but in addition to the complaints that are coming in there are also sweeps that regulators have been sort of initiating to be able to check GDP our readiness and so we have here on the slide that it's Dutch Data Protection Authority looking into you whether there's been sufficient compliance with gdpr through a selective group of companies I think about a hundred or so have been selected in various different industries and they're focusing more on whether the article 30 reports exist and are up you know are appropriate with respect to put it to just swing back to the litigation front for a second the you know obviously max schrems non profit group and why OBE you filed for actions on May 25th that's none of your business Gotti you for those of you that don't know about it though they were against Google and then it's Instagram whatsapp and Facebook more broadly those complaints were actually lodged with the regulators under Article 80 as representative actions which you know nonprofits are allowed to bring representative actions under the GDP are article 80 subsequent to that on May 31st there were another group of representative actions that were filed against Facebook Google and Apple Amazon and LinkedIn and those complaints are publicly available and those were filed in the French with the Camille in in France and then there's been a bunch of additional questions Francis sort of turned into a hub of a lot of these complaints but just to give some sense and we don't have all of them but just in the first 24 days after the GDP are a little over 400 complaints have been filed and that's from some eye apt data actually then here stateside we have seen a wave of collective actions have been filed in the u.s. recently basically in the in the form of shareholder derivative actions challenging companies for misrepresenting or allegedly misrepresenting the state of their GDP our readiness what's interesting to me and the the Nielson complaint that was filed is that this was not triggered by any complaints that had actually been lodged with supervisory authorities or complaints from EU residents about Nielsen's GDP our readiness this was just you know a shareholder you know that filed this this lawsuit in the Southern District of New York you know an American shareholder that filed the lawsuit you know taking the position that the GDP our readiness was not was not properly stated that's just something to give a sense that you know I guess I'm gonna give you like a little preview here of the difference between how the Europeans are reacting and and our our culture in the u.s. of litigation activity so you know there are lessons that we've learned obviously for in our class action history in the US that show patterns that we're starting to see that are arriving in the EU with respect to these representative actions so we're seeing coordinated activity there's a number of different organizations that have been involved lockwood in France and yov EU and many other consumer groups are putting on their website sort of you know pre said consumer or preset data subject request but data subjects can assert about complaints about these days they're focusing on the scope of consent on the website that's what we've seen but our turnkey tools that consumers can use to assert claims against companies in the EU they the other thing that's happening which is we've seen that's reflected it's sort of from the playbook of what goes on in the US a number of companies are got these data subject requests thought they might have only received one or two and when they actually dig under the hood or or they actually get served with the actual complaint that's been filed with the supervisory authority it's then that they learned that literally hundreds of complaints of data subject rights requests had been asserted against the company through the website or through a help desk or through other you know various means writing to you know individual employees and the problem there is without a coordinated strategy you've got companies that are providing differently you know varied responses to different requests and then there are also another thing that we see a lot in the u.s. that we're seeing in the EU with respect to these data subject requests they're sort of predicate acts that they are including in these demands that assume certain facts that may not be actually correct so to just before I leave this slide just to give an example a very common risk that we're seeing is that companies are receiving data subject requests that say delete all my data because the week all my data because I delete all my data because I'm withdrawing content and if it if the deletion or a ratio request is based on marketing data for example and the company is actually relying not on consent as a valid legal basis but rather legitimate interest many times companies are not making that differentiation they're just responding to that data subject saying oh yes we will delete your data within the next thirty days only to find later that when the complaints are filed against the company and the supervisory authority those those responses are being used as predicate acts to to claim that the company has admit that they are relying on consent as the basis for processing the data because they responded to the the data subject request without clarifying that they were relying on another valid legal basis like legitimate interest for their marketing okay so what have we seen on the fine front we haven't seen huge fines yet out of the EU with the regulator's you know of course we've heard about 4% of global turnover or 20 million euro and those larger fines are anticipated to start rolling in in 2019 but so far the fines have been relatively lowest as indicated on this slide I think the largest of fine has been issued by Portugal for four hundred thousand euro what's important for GPR in terms of you know the next phase now that so much of preliminary work was done to get to get compliant the important thing now is to to pay attention to keeping up the compliance but also paying attention to defenses when you are responding to data subject requests so I just put here on a slide we have a GDP our legal playbook that we've developed for clients but many other companies have you know can think through what works in their environment but you know there as I said for the ratio request for example you can only make them and under the GDP are under you know a set set of circumstances which are listed here like the data is no longer necessary for the purposes its collected or incentives withdrawn or they can challenge legitimate interest or there's you know various other means and if there is a defense even if you are going to voluntarily comply with the request it's important to indicate that yes well we will delete your data in 30 days but just we want to make it clear we're not processing it on the basis of consent or if there's if you know if a valid erasure request has not been asserted to make it a point even if you are going to comply with it voluntarily to make it a point that a valid request has not been it has not been made by the user very important to preserve defenses for litigation risks so that takes me to discuss you know the CCPA because the California consumer Privacy Act does also you know provide a number of data subject grades requests and just as a brief premier I think most of you will probably already know this but the lot actually doesn't effect January 1st 2020 it gives California consumers a lot of Rights that they did not have before and germane to this discussion and why we're talking about it now as it gives California consumers the right to have a 12-month look back so January 1st in 2020 California consumers can reach out to companies who collect their personal information or sell it and ask for information about those processes going back twelve months prior so what companies are doing today literally this month in 2019 to be able to track California data disclosures will have a direct impact on their ability to respond to these requests come January 1st 2020 a year from now the law applies to give these rights to consumers and consumers are defined as just any California resident who's in California resident is defined in our tax code and and that that definition is tied into and the deffend in the CCPA it means anybody that's in California on a non temporary basis so that's just you know kind of a very broad group it gives California consumers or California residents here these you know rights against businesses and then not every business is covered it's a business's company that's doing business in California and collects personal information of California residents that also has one of the three things here below and they just need to have one of them either the company has in excess of twenty five million in revenue or it buys or sells or shares personal information of fifty thousand or more California consumers or it derives fifty percent or more of its revenues from selling personal information with respect to the the second prong for businesses of collecting more than fifty fifty thousand or more collecting personal information from fifty thousand or more California consumers that might seem like a lot but if you are able to if you have a website and you're able to geolocate either through IP address or otherwise the location of the of the residents then that's going to be sufficient so in terms of the new rights let me just drill down very briefly and then talk about some things more specifically there is an abbreviated right to know about data that has collected the purposes and the categories of data that are collected under seventeen ninety eight point one hundred a there's an expanded right to know that California residents will get to know about how their data is used from companies that collect personal information and that's under seventeen ninety eight point one ten there is also a right to know about the sale of personal information and also disclosures for a business purpose so I wanted to emphasize that's under seventeen ninety eight point one one five I hear a lot about companies attempting to make a distinction between sale of data and whether something should constitute a sale first of all the definition of sale is very broad it includes any exchange for valuable consideration but even beyond that seventeen ninety eight point one fifteen does give California consumers the right to know about disclosures for a business purpose so just you know be aware that there's that component there's a right to opt out of the sale of personal information for adults and a right to opt in in other words you companies are prohibited from collecting personal information I mean from selling personal information from kids without opt-in content and the kids can provide that at Ages you know between ages 13 and 16 and under the age of thirteen parentals need to provide that Bobtown consent there's also a right to access and portability under seventeen ninety eight 100 d and then there's a right to deletion which is similar to the erasure right although there are a few more defenses to deletion rights in California and then there's also a right not to be discriminated against for asserting any of the rights that are one through seven so um I'll be you know brief here but just to go over some of the details of these rights I just we put these slides together to provide more specifics so for the abbreviated right to know for 100 a seventeen ninety eight point one hundred a a consumer can make a request of a company a verifiable request to know the categories of PII collected and the specific pieces of P I collected about the consumer and and of the purposes of those of that collection the second consumer right which has to do with the expanded right to know the consumers can issue a verifiable request to a company to know the categories of P I collected the categories of sources from which the P is collected the business or commercial purpose and the categories of third parties within the business shares in addition the specific pieces of P I that the company has has collected about that particular consumer can be requested you know this the the expanded right to know also includes a requirement to include some of this information in a privacy policy but I want to focus on the specific request the verifiable request that consumers can assert because that requires a level of granularity that may not that companies may not be thinking about it just just generally so then they're going to go to the consumer right number three the detailed right to know about personal information that sold or disclosed for a business purpose within 45 days the company is to identify the category or categories of consumers PII that's actually sold by the business and also the categories of PII that are disclosed for a business purpose and they need to be provide two separate lists and their specific requirements about the format of how that information is disclosed with the right to opt out once a consumer an adult asserts the right to opt out of the sale of their personal information then that opt-out must be respected and you cannot attempt to change the consumers mind or get them to you know change their decision to opt out for at least 12 months so there's backend compliance that companies need to put into place with respect to the right to opt in as I said you can get consent from children between the ages of 13 to 16 but you need their opt-in consent to sell their data and for kids under the age of 13 that you need to have a parent or a guardian give you consent for their for the sale of the data so this goes beyond copper with respect to the the 13 to 16 year olds with respect to the consumers right to access and portability this is the sixth right and this is under Section 17 98 point 100 D as a consumer asked to access the data you have to take steps to disclose it and then you can if you're providing it electronically it should be in a portable fashion I want to pause here as I've been describing all these rights I just want to make it clear there are a number of defenses to each of them that are both general and specific but just as a progressive just I'm giving you the rights that I'm not giving you every single defense that would go with them then the seventh rights the right to deletion once you receive a valid deletion request then you should delete the data on the basis of a verifiable request and the what constitutes a verifiable request will be forthcoming and guidelines that are being promulgated are being discussed and created by the California Attorney General's Office right now there are public hearings on that topic as well as various others that the California AG is involved in developing they've specifically asked and called for comments from industry - we have been covering the hearings the public hearings on Aria I know I apt has as well been really surprised at the few number of comments that are coming through and public hearings and so many industry verticals that have not been really represented in public comments so just wanted to let you know that on our portal at Perkins - we comm backslash ad tech you can find a link where you can provide comments specific comments that relate to your industry that will be provided to the AG's office in an anonymized format to at least get the business perspective out and then the 8th consumer right is the right not to be discriminated against this means that you cannot provide different you know levels or quality of goods and services for consumers exercising their right not to be not to be you know not to have their data either sold or or you know any other right that they might have asserted to request data under rights numbers 1 through 7 you can however provide financial incentives for data and it has to be linked to the value of the data so conversations right now to be had with you know your marketing teams and others to help figure out the value of data for things like loyalty or coupons or other sort of promotions that you might want to give and they and before I get to the independent business obligations I'll just say it's kind of interesting my old alma mater at Brown University there's a cafe that literally allows students to come in and provide their personal information as the actual consideration for the coffee or they can they can decide to pay for a cup of coffee so you might see more sort of transparent things like that popping up at posts ECPA the other thing so I talked to you about all the business obligations that go with the consumer rights but there are three independent business obligations I want to bring to your attention number one and these are not tied to any particular to consumer right but they're required under the statutes the companies must train those employees that will be responsible for answering questions about personal information and and handling personal information about the consumer rights sets that California consumers do have they must also create designated methods for asserting rights under the statute and there's some specific guidance in the statute of some suggested ways for giving methods for certain rights are an 800 number and if a company has a website for a website you know icon or notice so that company consumers to know how to assert their right but the California AG again is going to be probably promulgating regulations on this very topic and it's an opportunity for business to get involved in if I said we've we had a representative from the California AG's office speak in our office Ellie bloom and she's specifically called for business comment on these topics among other things and then you can also obtain immunity a company if they want to obtain immunity for any violations of the CCPA by their vendors then they must include certain verbiage in their contracts and a lot of this does match the verbiage that is in article 28 in terms of the vendor not selling the data or using it for any purpose that's not authorized but then they're there also should be a certification that the data will be you know that laws will be complied with and that those working on working with the data will maintain confidentiality and integrity of the data okay and with that I just we'll wrap up here really quickly with the defenses so there's some general defenses and their specific defenses I'm just going to give you an overview of some of the general ones company could say that they're not a business if they don't meet the threshold that you're not dealing with PII personal information is defined in the statute under 17 98.1 40 oh and there's some specific things in the P I definitely you know inference data and biometrics - which includes facial recognition for you to pay attention to but if you're not collecting the things that are in 1790 8.1 4000 you can take that data select is collected for a single one-time transaction you know or the data would require a business - reaiiy denta fie information if you're another defense is if the information is publicly available and you're you are using it in a way that's consistent with the way that it was made publicly available by the user that is another defense there are political exemptions in the statute for things like data that's collected pursuant to GL da but keep in mind those are not a lot of those defense exemptions have loopholes in them so you need to really look closely like you know what for like a website for a financial institution they might be collecting cookies for non customers and they're you know you're outside of GLBA at that point so just really look closely at those objections but you might have abilities to assert of defense there and or you can't respond to the request because you don't have enough information to verify the identity of the user and look out for guidance from the attorney general's office in may on that topic we have a legal playbook and in our firm really about how to preserve the defenses similar to what we did with gdpr and here's some you know examples of you know the specific things that could be included in an abbreviated response and with that I'm going to turn it over to Ben feet great thanks Dominique and you know thanks for this very easy dive into the different rights that are available in HTTP a and JP are for the background - at the beginning that was very informative and very helpful so I think with that kind of first part it's first to say that I feel free overwhelming probably especially for companies is what that are maybe only based in California and we're not subject to GPR so having been looking in the GDP our consideration for a while and and there's definitely a lot in both of these laws and now we're kind of in that second part going to look at what you can and practice within your organization to address all those requirements in the most efficient way possible first I'm gonna just take a bit of a step back and look at the more bigger pictures because you know today's topic was with both book logs and that made just the right step and if it's definitely the most prominent part especially to GPA but there is some there is some other key overlaps in the law that that we touched on a bit already but that I will cover in a bit more details right now so there's some overlap on the type of data that's concerned are the entities and the individuals who are protected the GTR defines personal data as any information relating to an identified or identifiable natural person that the loss of data subject and and defines an identifiable person as one who can be identified directly or indirectly in particular by reference to an other identifier online identifier and gives some other examples as well so bottom line here is that it's a very very broad definition and CCPA has an equally broad definition of what it costs personal information as information that identifies really to describe it's capable of being associated with or could reasonably be linked directly or indirectly with a particular consumer or household important here to kind of point out this household edition that you know we don't we don't usually see and that can add things up pretty quickly so obvious identifiers and we know such as name social security number but also some more interesting ones as the internet or other network activity information that includes browsing history search history and there's also this interesting one that's any insurance that is drawn from any of this information it's being used to create a profile about a consumer so in CPP as well extremely broad definition of personal information and one difference though to note is that personal information to date include some exception Dominique mention it a bit earlier and it excludes publicly available information so it has a definition of it too which is information that is lawfully made available in federal state or local government records provided that data used for a purpose compatible with the ones for which it's maintained and made available in the record quick note here also is that TCPA has some exclusion from its overall a scope of application and for example medical information governed by other laws such as any medical information is governed by the confidentiality of medical information acts or another example of exclusion would be personal information that's collected process sold or disclose for students to the gramm-leach-bliley Act so those are just a few examples but that can to a certain expand you know narrow the definition of personal information and regarding the entities that are covered there is some of the PCP a fairly narrower than GTR here the GTR applies to national or legal persons so that means people and companies so that includes associations or non-for-profit public bodies and institutions whereas as again Dominic explain a bit earlier CCPA covers only for-profit entities that do business in California and that meet one of the threshold that she presented so a bit narrower in that sense that said the you know the threshold can be met pretty easily especially the one in the you know 50,000 or more consumer household or devices I can add up pretty quickly and finally so GTR covers data subjects where it's identifiable natural persons only so it doesn't include companies and cgpa covers of consumers more a California resident very quickly to was kind of already touched on that but another area of overlap sensors children and it's just the you know interesting point here so to make is that there's a particular attention and and a recognition that children's data need a higher level of protection in some circumstances so CCPA has a blanket prohibition for the sale of children's data for children under 16 requires up in and the parents authorization if the child is under 13 from the child himself or herself is under 16 and junichi are of only that the child consent requirement only applies in relation to the offer of information society services directly to the child so that's a bit narrower and it requires seeing the parent consent or the child depending on the age and and those can vary per member state so there is undoubtedly some overlap between the two laws but there are also some important difference in the GDP re is much broader than CPP overall the law the European law applies to the processing of personal data holyoke certainly by automated means or non automated means if the data is part of the filing system and the term processing itself which is defining the regulation could hardly be butter and it covers any operation or set of operation that's performed on personal data and it includes you anything collecting using disclosing that are you know the most obvious ones but also structuring storing recording making available and so on the CCPA on the other hand is the bit narrower and that obligations are imposed on businesses that collect sell or disclose personal information about a consumer but not to all kinds of operations performed on that personal information the GTR is also principal based and includes the requirement that any processing performed on personal data be based on one of the six legal bases that are available so for example consent such an interest performance of a contract to name a few CCTA does not have such requirement so you know the main difference here is TVPA regulate specific aspects of the processing the cell is a good example but not kind of the overall treatment processing of data that the company holds as GTR does so GDP are also has many more requirements in comparison to GDP a for example control of the processor is must maintain a record of their processing activities there is the requirement to perform dpi is in some circumstances having some type of safeguards for any transfers personal data outside of the EU breach notification requirements appointing a video etc so this piece EPA is more focused on providing rights to consumer to protect them from data misuse and to acquire transparency from businesses regarding their personal information so a bit more focus in the Sun and there's another main difference it has to do with vendor management what we'll touch on that a bit later when when am who talk about that and so you know the CD itself doesn't include all obligations that exist in GDP are but you took with no so that you know California has other laws that cover some of these areas and a good example being at the data breach notification law so while the goal of GTR was time to take a broad overall approach to regulating the processing of personal data you know businesses that are subjected to DBA or operating California these don't may have more privacy or security security related obligations and then those strictly contained in 50 day only so finally if you close on the subject of the overlap and differences between the two I want to just give a quick word of advice and reminded the devil is in the details so even if there are some apparent similarities it's very important when it comes to new strict compliance and implementation within your organization to look at the specifics of each carefully when it comes to scope definitions exceptions you Dominique made a good point explained that the the right of the erasure for GDP are only apply the circumstances and gave a good example of how that can kind of you know come back to your face even if it was not intended so we're going to look at how to address both laws in the most efficient way so there are some practical steps that you can take to implement both pieces of legislation within your organization's because again while there are some differences in each in terms of the specific requirements when it comes to the processes that you can put in place internally to comply those can be leveraged to cover both laws the facility things to the extent possible it's good to work on compliance with a holistic approach and ideally as part of one kind of global privacy program and as we're about to see in just a moment there are lots of areas that can be approached you know again globally and then the actual process itself or incorporates with the differences between the two laws and now met Andrew I start with that yes thank you for that important to go over the key overlaps and differences and now we'd like to take a look at the you know the operational steps that are important and reaction to these rights and kind of get get to the action that you can be taking right now so a good place to start would be to understand what your organization does already and has in place and one of the reasons for this format and thinking about the the GTR in relations to the CCPA is that we're trying to see where you might be able to leverage work that that's been well done or something that you used before that can be tailored for this is usually a good place to start and our readiness assessment is a great way for you to figure out where your gaps are and make sure that you understand the points that need to be addressed and the measures and processes that you need to put in place and order should be ready some of these resources will focus totally on the CCPA other resources are more comprehensive and will allow you to assess readiness with one questionnaire again multiple regime like the gdpr and the CCPA so that that sometimes can be the best approach because it will give you the best overall view to where the organization is in its readiness and when do you think about starting it's important to think about starting now so there's something that's referred to as the look-back requirement the look-back requirement like an example would be the right to request access looks about 12 months of the previous 12 months and since the enforcement date is January 1st 2020 you should be already trying to get your records in place make some accurate and findable in such a way that is going to be something that you can achieve that on the effective date and so perhaps the best way to make things findable is to start with updating or maybe to just beginning and data inventory and record-keeping process that your company so if you have experience with the gdpr you'll be familiar with these steps and you'll already have a great starting point so you shouldn't be reinventing the wheel here but as you've seen through previous presenters there are important details that are different here so you're not simply extending the same point in order to to cover this there are some new obligations that need to be captured and it's also worth pointing out that this this is an activity that in support of other activities right so this is something that needs to be done in order to carry out other requests it's not in itself you know the requirement that you're trying to be the thing that's supporting the requirements that you're trying to be so the first step here of creating a map a record of processing activities is so that when you are going to receive a data subject request you are able to do proper fulfillment of that request if there is a breach that you'd be able to map back where necessary and and learn as quickly as you can what's going on when we talk about risk assessments and CIA's later having good awareness of the processing that's happening within your company and if GE PR is not an area of overlap for you you may find that there are some things you can leverage on the security side of things many companies will have a program such as ISO 27001 that at least had an asset map that can be a starting point that leads you down the road to collecting the right information that would be important for your records in this case so highlight a few we should be looking here understanding the categories of personal information collected but also importantly what is sold the specific pieces of was collected the categories of the sources the purpose for not only collecting but also selling and the categories of third parties with whom you share so you can think about this as in the context of the example of the right for information request and I think it becomes clear how this would be useful I should also point out from a practical point of view that this is another area where integrations with other processes and tools can be important the the obvious integration here being one with how it is that you're going to receive your dated subject requests may want to try to get some integration in place there to make that more helpful so just look back across what's important we're talking about enabling the fulfillment of consumer rights request through through this data inventory we're identifying the flows and where and whether something is sold and again we're looking to get this done as soon as possible due to look this look-back requirement that that says stay here records need to be in order so I will hand this back you for a few additional tests one of these and then I'll pick it up again for you yes great thanks Andrew so our third step here is to look at the privacy notice and and policies generally so both TPPA and gdpr have requirements around the information that as a business you need to disclose to individual for the sake of time I won't give too much details on those but in CCPA businesses must disclose to consumers the calories of personal information we collected purposes of the use the right consumers have and that the business personal information and that consumers have a right to opt out there's some information to disclose in the online privacy policy if the business has one so this is you know all included in NC GPA and GPA are addressing the information to be provided to individuals in article 13 and 14 it's a bit more broader than cgpa includes things like identity and contact details of the controller the purposes of processing as well as the legal basis and of course the rights that people have so you know main point here from and kind of operationalize operational I'm sorry standpoint it's to kind of you know take a bigger view of this look at your notice and see how you can kind of incorporate all the requirements from each and organize it in a you know a proper within the notice so it works for both your residents and and California residents as well so for example how they use kind of a big you're right section and depending on on how as a company you know whether you want to take the global approach grants rights to more people than you have to or not organized you're known as accordingly and one and of course you know we've talked about this extensively and and rights are really at the heart of each of these laws so one you know crucial aspect here for whether it's for data subject request under GTR or consumer request under CGPA that it will be for your business to have a very solid process in place to kind of handle on manage though so there are several things to consider for that purpose so the first one is how as an organization you're labeling or facilitating those rights such requests from people so CPA does require at a minimum that you provide a toll-free telephone number and website address if your business has a website gzr you know only mentioned that you do need to facilitate and enable those it doesn't have specific requirements like CCPA does but you know you can think of different ways you can offer standardized web form on your website or other means of submission you can have the dedicated call centre customer support and person etc asset those are definitely aspects to think about the second kind of second aspect is what is expected of their employees will receive the request and how to handle them so that you know imply depending on the nature of your business to understand who within your organization with employee are likely to receive this request to make sure that you don't miss one again under you know both laws it's very high fines or or suspensions total it's very important not to miss one there are strict timelines to respond to individual so you know need to make sure that you capture those the review process for each request as well so what action should be taken what kind of you know workflow process you want to take to manage those under a GP are you I need to make sure called verifying the identity of the person so you basically just making sure of course this person that you receive the request from is you know the actual person that's making it and under CCPA is called a verifiable consumer request and this there will be more the AG is expected to take issue regulations to explain the details on how to verify those but there is kind of stuff verifying the identity of the person and also whether it is applicable so for you know both is supposed to be free of charge but then if you get manifestly Iranian or excessive request or to cover administrative costs if people ask for additional copies for example those are instances where you may request to see so that's another you know things to figure out and then how requests will be carried out internally so that's obviously the key and as you know Andrew explained a few minutes ago this is nice when you have proper data inventory so you know exactly where to look and who don't ask to obtain the data delete the data or rectify etc and finally you know the response fees and responding to data subjects so you need to make sure that you have a secure and effective process to respond and transmit data it's portable and as I mentioned for clean as well the the required time line so GPR the standard 30 days since BPA's 45 days so you know again kind of approach this as a whole it would be it's good to think about creating different template responses so that you can standardize as much as possible those responses to people based on which regulation is fake and maybe also want to be putting this overall process or checklist into a company policy or SOP our stuff here is provide this off south a mechanism so this one is specific to CCP a which has a very size requirement that's the business provide a do not sell my personal information button to enable you know consumers to easily exercise this right to apply on the cells their personal information so if you're using a tool to manage your consumer or data subject requests you may think about a time that one to your standard workflow as well to capture it there and you know just a few very important consideration here will be to accurately track when that up south is made by a consumer and there's two main reasons here and one the business that needs to stop selling that information S or the requested me so that's pretty obvious and the second one is that there's the possibility of the business to reach out to the customer 12 months after as to ask if they would authorize the sale again but that you know implies knowing when when it's safe to do so so when the opt-out was made precisely Andrew Android on you okay yes thanks let me pick out the training so training is often dealt with something that would be good to have in this case it is a requirement Pat so we should definitely take a moment to make sure that we understand this teeth you look at 1798 130 and 135 you'll see that the scope is not everyone in the entire company but the individual is responsible for handling the consumer inquiry so that's an important to note and those individuals need to be informed of all the requirements and how to direct to consumers to exercise their rights so in this case we're going to certainly focus on that that training aspect but there's a secondary piece here which implies that there's probably policies and processes that need to be updated in order to make these changes and also perhaps updating to marketing as well to make sure that that communication is happening additionally it's probably a best practice in this case to set up some sort of verification that the training is working you know quizzes could be collected there might be a regular schedule that's put in place and this is an area where because the GPR didn't have a specific requirement you might not be able to leverage some of you or your previous work and that said I do think that one of the things to focus on would be the recognition of the request already we've noted discussion about needing to have hundred-number or if you have a website a place to make a request via the web I think this is an area that we want to spend a little bit more time learning about once there is additional information and details on what this needs to look like but I think you know it's possible that there will be other means that these requests are coming in and you want to make sure that it's there they're not missing out all right few quick additional actions to be taken J'son privacy by design is not one of the required things but it's a piece that helps manage overall risk and is going to assist with the overall program strength than responding to the CCPA so specifically you're probably going to be looking proactively inventing privacy throughout the business this is the goal of privacy by design but the task that you'll be carrying out are integrating probably tasks like privacy impact assessments throughout the business to make sure that you're taking care of these things and a way to map this back I think is that although there isn't a specific requirements for privacy by design it does show up within the CCPA that there are Fair Information practice principles and in order to react to those principles this is one of you were best approaches it's also a good time to remember that you are not alone in your obligations here this is a shared responsibility and take a moment to look out at your network of privacy champions if you have them you don't this would be a good time to start building them and make sure that that your goal of speaking privacy into all the areas of the businesses is carried out by making sure that there are other people that are you know an extension of your team that are aware of that needs to be going on and possibly will be participating in that training that you just spoke about and then the final piece here is that vendor management is something that was very clear in the GPR to go to art twenty-eight the requirements were very precise the contract had to include specific septic matter talk about the duration of processing the nature and the purpose of the processing the types of personal data etc and the CCPA there's a little bit lighter detail on how this works but Dominique pointed out earlier it's an incredibly important piece of the puzzle so you're going to want to make sure that you know for example if there's a deletion request and you're going to be able to go to your vendor in there they're going to know how to work with you and have the obligation to work with you and I think that review is best carry that through a comprehensive process of vendor management two other quick items obviously once I've put together a full response solution for this but there are some tools that are made available specifically that I think would be nice to highlight you know one is our mobile app that quick search the full text and CTA can highlight bookmark thing and get news updates and hopefully get a chance to operationalize some of the things that we spoke about today and as you're working toward a lot of these new program objectives is sometimes helped to talk to others and we've announced our 2019 schedule for privacy connect which has 100 you know positive and 80 cities and good coverage of the CCPA so hopefully we can share some practical tips there and you can also sign up to participate in monthly thought leadership webinars in in that case as well well I guess I'll hand this back to you then thank you yeah terrific thanks so much Andrew and thanks Benedict and Dominique that was a fantastic very rich information filled or I hope that those of you the dialed in got a lot of what you were looking for we got a number of questions that came in throughout the program we've answered some of them in writing and we'll just about up finished with the hour here but what we're going to do is we're going to export some of the questions and go through them and were going to try to respond to as many as we can in writing on the one websites so hop on over there onto their educational programs page and look for some answers to those in the future additionally as you can see on the slide right in front of you right now all of our email addresses are available those are live links so I might suggest that you go ahead and click on one of those email addresses to queue up an email and get your question in I'm sure that Andrew and Mandy can Dominique would be happy to respond to you as they can so please get those in and again we're going to do our best to tackle the questions that we weren't able to answer directly in writing following the program so a huge thank you to one trust for supporting this program today making it available to all of you for free we here at the IPP very much appreciate the support of one trust it's a great partnership we have with them and for providing this information to to you our membership in the audience out there today so thank you very much one trust uh Andrew man I think it's great to have your support and let's and all of you for taking some time to be here today as well I wanted to ask if you have just literally two minutes left to let us know how we did on this program today that's a link in front of you to a quick survey with just a few questions to let you give us some feedback about whether we met your expectations for today so if you wouldn't mind just clicking on that and and giving us that feedback we would very much appreciate it there is a field in that survey that allows you to let us know what topics you'd like to hear about on future privacy education webinars and we look at that regularly in order to build our educational programs so please hop on over there let us know how we did and let us know what topics and subjects you'd like to hear about in the future as I mentioned the beginning of the program if you are and I to be certified privacy professional and you registered for this web conference you will automatically be granted one C PE credit toward the upkeep of your certification that's going to be taking care of you automatically if for some reason your listening to this recording you can still get that CPE credit by going to the IEP website and the certification and filling out a very quick form and we can grant that credit for you if you're an attorney and you're wondering about continuing legal education or CME credits we do not pre certify these web conferences so you'll need to apply in your particular jurisdiction and if you need supporting materials they can be found through live links under the video viewing window of this recording if you're viewing it online now and you can also feel free to contact me and I can do what I can to help provide them so Andrew Benedict and Dominique thank you all so much for sharing your expertise with us today thank you Thanks and with that will take us to a program closed and hope to see you on another