Attorney Andrew Clearwater, vice president of privacy at OneTrust, an Atlanta-based privacy and compliance technology company, outlined five broad steps that health care entities and other California companies can follow to comply with the California Consumer Privacy Act (CCPA), which took effect July 1.
The steps fall into five categories, Clearwater said:
-
Consumer rights requests,
-
Opting out of sale of information,
-
Internal governance,
-
Policy and disclosure management, and
-
Ongoing compliance.
Each of these steps requires a series of actions by a company that does business in California and is covered by the CCPA, he said, adding, “I’m trying to simplify some of the things you could be approaching here as you get ready” to comply with the law.
Consumer Rights Requests
To comply with this part of the CCPA, companies should:
◆ Create and/or update procedures for receiving and fulfilling consumer access requests. This can be complicated, Clearwater said. For example, companies must provide two or more designated contact methods (e.g., a toll-free phone number and a web address). Firms also cannot require the consumer to create an account for this purpose.
◆ Update company websites and privacy policies to include a “Do not sell” button for protected information. California has guidance on this, which can be confusing, Clearwater said.
◆ Establish mechanisms to verify consumer identities. Verifying identity can be outsourced to a third-party validation vendor, Clearwater said. Alternatively, the company can leverage existing security questions or authentication portals, or an ID or past billing statement can be requested and automatically deleted after use. All possible methods are complicated, he said.
◆ Set up a toll-free number for California residents to submit consumer rights requests.
◆ Set up a consumer rights management portal.
◆ Identify and train employees responsible for handling CCPA-related consumer inquiries.
Companies also will need to implement a consumer rights requests process, with a way to triage and track requests, Clearwater said. Requests must be free, and companies must honor requests within 45 days of receipt, make certain they cover a 12-month period preceding receipt of the request, and be disclosed in a readily usable format, he said.
Finally, companies will need to track the history of fulfilled requests, keep records for 24 months for accountability and comply with disclosure requirements, he said.
