What can I do if my CCPA request is being ignored? I’m a California resident and requested to inspect my data with a certain tech company using their online form. That is now over 3 months ago. Two weeks ago, I followed up with them by email. So far I have not received any acknowledgment or confirmation that my request has been received. I read somewhere that companies have 45 days to respond to such a request but that they can also get an extension. In any event, I’d like to know for how much longer I should wait and what I can do if my request is not responded to?
Overview of the CCPA The CCPA constitutes California Civil Code TITLE 1.81.5. California Consumer Privacy Act of 2018 (sections 1798.100 - 1798.199.100) (Note: the online version gives both original and amended versions of many of the code sections. Be careful to refer to the current version, which is usually the last version of the section provided.) Additional The CALIFORNIA CONSUMER PRIVACY ACT REGULATIONS (also known as Title II, Division 1, Chapter 20) are regulations issued by the California Attorney General, as required byn the CCPA, implementing and interpreting the CCPA. They include sections 999.300 et seq. Section 1798.110 allows a consumer to request that the business provide information about its collection of personal information, as well as a copy of the information actually collected. The information must be disclosed &quot;upon receipt of a verifiable consumer request from the consumer.&quot; Section 1798.105 allows a consumer to request deletion of information, and Section 1798.106 allows a consumer to request correction of incorrect information. Sections 1798.115 and 1798.120 grant additional rights when the business shares or sells information. Section 1798.130 specifies that a business must respond to requests from consumers within 45 days. Actual fulfillment of the request can be delayed fro a further 45 days, provided that the consumer is given notice within the first 45 days. A business must provide reasonable methods to submit a request. For an online-only business, an email address is enough. Otherwise an 800 phone number must be one of the ways. Consumers must use one of the methods specified by the business, and must provide enough information for the request to be &quot;verifiable&quot;. (But the business must respond to requests made by other methods.) Additional Regulations section 999.308 (c) (1)08 (c) (1) b and 999.308 (c) (1) c say that a business must provide in its privacy policy instructions on how to submit a request for information (called a &quot;request to know&quot;) with links to a an online form or portal for this purpose, and a description of the verification process. Additional Regulations section 999.312 subsections (a), (b), and (c) indicate how the business may select the methods for a consumer to submit a request to know. 999.312 (e) says that when a consumer submits a request through some method other than one of the4 designated methods, or submits a request that is incomplete, the business must either treat it as having been proerply submitted, or inform the consumer how to correct or properly resubmit the request. Additional Regulations section 999.313 say that a business must acknowledge the request within 10 days &quot;and provide information about how the business will process the request.&quot; Additional Regulations section 999.313 subsections (c) (1) and (c) (2) say that if the business cannot verify the identity of the consumer it may deny the request, but must respond informing the requestor that it could not verify his or her identity and also giving more general information. Sections 1798.145 and 1798.146 list various exemptions and limitations on the obligations of a business. In particular, the CCPA does not apply to medical information covered by the Federal HIPAA law. Under section 1798.150 a consumer whose information was improperly accessed and taken can sue for an amount between $100 and $750 per incident, or the amount of actual damages. The CA Attorney General has issued detailed implementing regulations for various provisions of the CCPA. See link above Under section 1798.155 a business can be fined up to $2,500 fore each violation of the CCPA, or up to $7,500 for each intentional violation with respect to consumers under 16. Only the California Privacy Protection Agency may enforce such fines. Conclusions A Consumer must make a request by one of the designated methods provided by a business, or it may be ignored. The business has to inform consumers about those methods. Email and telephone are likely methods, as is a form on the business's web site. The consumer must provide enough information that the business can verify that the request is valid. The business must inform requestors who use an improper method or did not supply sufficient identification information of how to correct or resubmit the request. The business has 45 days to respond, and up to an additional 45 days to actually provide, correct, or delete the information, but only if the extra time is reasonably required. It must, however, acknowledge requests within 10 days. If the business does not comply, the consumer cannot directly sue. Instead the consumer may complain to the California Privacy Protection Agency, which can (but need not) investigate, and may hold a hearing and impose a fine after such a hearing. If there is an information breech a consumer can sue directly. Specific Provisions 1798.110 Consumers’ Right to Know What Personal Information is Being Collected. Right to Access Personal Information (a) A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer the following: (a) (1) The categories of personal information it has collected about that consumer. (a) (2) The categories of sources from which the personal information is collected. (a) (3) The business or commercial purpose for collecting, selling, or sharing personal information. (a) (4) The categories of third parties to whom the business discloses personal information. (a) (5) The specific pieces of personal information it has collected about that consumer. 1798.130 Notice, Disclosure, Correction, and Deletion Requirements (a) In order to comply with Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125, a business shall, in a form that is reasonably accessible to consumers: (a) (1) (A) Make available to consumers two or more designated methods for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115, including, at a minimum, a toll-free telephone number. A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115. (a) (1) (B) If the business maintains an internet website, make the internet website available to consumers to submit requests for information required to be disclosed pursuant to Sections 1798.110 and 1798.115. (a) (2) Disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request from the consumer. The business shall promptly take steps to determine whether the request is a verifiable consumer request, but this shall not extend the business’ duty to disclose and deliver the information within 45 days of receipt of the consumer’s request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary, provided the consumer is provided notice of the extension within the first 45-day period. The disclosure shall cover the 12-month period preceding the business’ receipt of the verifiable consumer request and shall be made in writing and delivered through the consumer’s account with the business, if the consumer maintains an account with the business, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with the business, in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance. The business may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account with the business in order to make a verifiable consumer request. If the consumer maintains an account with the business, the business may require the consumer to submit the request through that account. ... (a) (5) Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and in any California-specific description of consumers’ privacy rights, or if the business does not maintain those policies, on its internet website and update that information at least once every 12 months: (a) (5) (A) A description of a consumer’s rights pursuant to Sections 1798.100, 1798.105, 1798.110, 1798.115, and 1798.125 and one or more designated methods for submitting requests. (a) (5) (B) For purposes of subdivision (c) of Section 1798.110, a list of the categories of personal information it has collected about consumers in the preceding 12 months by reference to the enumerated category or categories in subdivision (c) that most closely describe the personal information collected. ... (b) A business is not obligated to provide the information required by Sections 1798.110 and 1798.115 to the same consumer more than twice in a 12-month period. 1798.150 Personal Information Security Breaches (a) (1) Any consumer whose nonencrypted and nonredacted personal information, as defined in subparagraph (A) of paragraph (1) of subdivision (d) of Section 1798.81.5, or whose email address in combination with a password or security question and answer that would permit access to the account is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action for any of the following: (a) (1) (A) To recover damages in an amount not less than one hundred dollars ($100) and not greater than seven hundred and fifty ($750) per consumer per incident or actual damages, whichever is greater. ... (b) Actions pursuant to this section may be brought by a consumer if, prior to initiating any action against a business for statutory damages on an individual or class-wide basis, a consumer provides a business 30 days’ written notice identifying the specific provisions of this title the consumer alleges have been or are being violated. In the event a cure is possible, if within the 30 days the business actually cures the noticed violation and provides the consumer an express written statement that the violations have been cured and that no further violations shall occur, no action for individual statutory damages or class-wide statutory damages may be initiated against the business. ... (c) The cause of action established by this section shall apply only to violations as defined in subdivision (a) and shall not be based on violations of any other section of this title. Nothing in this title shall be interpreted to serve as the basis for a private right of action under any other law. 1798.155. Administrative Enforcement (a) Any business, service provider, contractor, or other person that violates this title shall be liable for an administrative fine of not more than two thousand five hundred dollars ($2,500) for each violation or seven thousand five hundred dollars ($7,500) for each intentional violation or violations involving the personal information of consumers whom the business, service provider, contractor, or other person has actual knowledge are under 16 years of age, as adjusted pursuant to paragraph (5) of subdivision (a) of Section 1798.185, in an administrative enforcement action brought by the California Privacy Protection Agency. 1798.192 Waiver Any provision of a contract or agreement of any kind, including a representative action waiver, that purports to waive or limit in any way rights under this title, including, but not limited to, any right to a remedy or means of enforcement, shall be deemed contrary to public policy and shall be void and unenforceable. ... Excerpts from the Regulations § 999.308 Privacy Policy. (a) Purpose and General Principles (a) (1) The purpose of the privacy policy is to provide consumers with a comprehensive description of a business’s online and offline practices regarding the collection, use, disclosure, and sale of personal information and of the rights of consumers regarding their personal information (b) The privacy policy shall be posted online through a conspicuous link using the word “privacy” on the business’s website homepage or on the download or landing page of a mobile application. ... (c) The privacy policy shall include the following information: (c) (1) Right to Know About Personal Information Collected, Disclosed, or Sold. a. Explanation that a consumer has the right to request that the business disclose what personal information it collects, uses, discloses, and sells. b. Instructions for submitting a verifiable consumer request to know and links to an online request form or portal for making the request, if offered by the business. c. General description of the process the business will use to verify the consumer request, including any information the consumer must provide. d. Identification of the categories of personal information the business has collected about consumers in the preceding 12 months. The categories shall be described in a manner that provides consumers a meaningful understanding of the information being collected. ... § 999.312. Methods for Submitting Requests to Know and Requests to Delete. (a) A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information shall only be required to provide an email address for submitting requests to know. All other businesses shall provide two or more designated methods for submitting requests to know, including, at a minimum, a toll-free telephone number. Other acceptable methods for submitting these requests include, but are not limited to, a designated email address, a form submitted in person, and a form submitted through the mail. (b) A business shall provide two or more designated methods for submitting requests to delete. Acceptable methods for submitting these requests include, but are not limited to, a toll-free phone number, a link or form available online through a business’s website, a designated email address, a form submitted in person, and a form submitted through the mail. (c) A business shall consider the methods by which it primarily interacts with consumers when determining which methods to provide for submitting requests to know and requests to delete. If the business interacts with consumers in person, the business shall consider providing an in-person method such as a printed form the consumer can directly submit or send by mail, a tablet or computer portal that allows the consumer to complete and submit an online form, or a telephone with which the consumer can call the business’s toll-free number ... (e) If a consumer submits a request in a manner that is not one of the designated methods of submission, or is deficient in some manner unrelated to the verification process, the business shall either: (e) (1) Treat the request as if it had been submitted in accordance with the business’s designated manner, or (e) (2) Provide the consumer with information on how to submit the request or remedy any deficiencies with the request, if applicable. § 999.313. Responding to Requests to Know and Requests to Delete. (a) Upon receiving a request to know or a request to delete, a business shall confirm receipt of the request within 10 business days and provide information about how the business will process the request. The information provided shall describe in general the business’s verification process and when the consumer should expect a response, except in instances where the business has already granted or denied the request. The confirmation may be given in the same manner in which the request was received. For example, if the request is made over the phone, the confirmation may be given orally during the phone call. (b) Businesses shall respond to requests to know and requests to delete within 45 calendar days. The 45-day period will begin on the day that the business receives the request, regardless of time required to verify the request. If the business cannot verify the consumer within the 45day time period, the business may deny the request. If necessary, businesses may take up to an additional 45 calendar days to respond to the consumer’s request, for a maximum total of 90 calendar days from the day the request is received, provided that the business provides the consumer with notice and an explanation of the reason that the business will take more than 45 days to respond to the request ... (c) Responding to Requests to Know. (c) (1) For requests that seek the disclosure of specific pieces of information about the consumer, if a business cannot verify the identity of the person making the request pursuant to the regulations set forth in Article 4, the business shall not disclose any specific pieces of personal information to the requestor and shall inform the requestor that it cannot verify their identity. If the request is denied in whole or in part, the business shall also evaluate the consumer’s request as if it is seeking the disclosure of categories of personal information about the consumer pursuant to subsection (c)(2). (c) (2) For requests that seek the disclosure of categories of personal information about the consumer, if a business cannot verify the identity of the person making the request pursuant to the regulations set forth in Article 4, the business may deny the request to disclose the categories and other information requested and shall inform the requestor that it cannot verify their identity. If the request is denied in whole or in part, the business shall provide or direct the consumer to its general business practices regarding the collection, maintenance, and sale of personal information set forth in its privacy policy. ... (c) (5) If a business denies a consumer’s verified request to know specific pieces of personal information, in whole or in part, because of a conflict with federal or state law, or an exception to the CCPA, the business shall inform the requestor and explain the basis for the denial, unless prohibited from doing so by law. If the request is denied only in part, the business shall disclose the other information sought by the consumer.
"Fraud" requires an intent to deceive. In cases like this I would fall back on the saying, "Never attribute to malice what can be explained by incompetence." Practically speaking: the email you received from them is an amendment to their Terms of Service. I.e., your contract with the company starts with their standard Terms of Service, and is modified by any agreement you reach that explicitly supersedes the ToS. Based on your description it is your credit card company that is in violation of its duty to adjudicate chargebacks. If you refuse the charge, and present the email agreement and evidence of A's "failure," then the card company has no grounds to impose the charge on you (unless the merchant in its response to the chargeback can convincingly argue that the email agreement is invalid).
The U.S. could pass a law directing Apple to create software for fair compensation. Similar statutes have been passed in wartime compelling companies to do all sorts of things and companies don't have all of the rights of individuals. If it can be done (not obvious in the case of existing products in the market place), it might be possible for the government to compel it to do so; if it can't be done, it can't be compelled and not all things are possible retroactively. There would also be a constitutional contracts clause issues with such a law impairing contracts between Apple and its customers when applied to existing phones retroactively. Whether it could require Apple to create a law enforcement back door depends upon whether 4th Amendment privacy rights trump the creation of a means to do so. There is an expectation of privacy in electronic records, but it is not absolute. But, there is no law on the books requiring this from Apple. It does not flow naturally from existing powers of law enforcement under existing statutes. It goes beyond what a subpoena would ordinarily require someone to do, and a subpoena is the main means by which governments compel people to provide information. In my opinion, a court faced with that question would rule that a statute requiring Apple to do this prospectively would be constitutional, but no such statute exists. However, this is currently an open legal question because there is no statute of the kind that have been litigated in a manner that produced a binding precedent.
IANAL, and as @GeorgeBailey suggests, you should ask one. That said, some aspects of your question are directly addressable with what we know. Does US law states anything about this? Yes. Federally this falls under the Wiretap Act, 18 U.S.C. §2511. Workplace monitoring generally falls under either the "System Administrator Exception" or under Consent. In general, continuing past a banner constitutes consent. Does company policy enforcement with such a warning over ride the right to not be subject to surveillance? In general, yes. You don't need to use the companies network if you don't want to consent - and they don't need to hire you if you don't want to use their network. But it's their network, and their rules apply. There are some nuances, and courts have found that the wording of the notice has made a difference in some cases, but overall, if the systems are properly posted with banners, then the employer may capture communications. See the "Bannering and Consent" section of this article from cybertelecom.org, e.g.: Even if no clicking is required, a user who sees the banner before logging on to the network has received notice of the monitoring. By using the network in light of the notice, the user impliedly consents to monitoring pursuant to 18 U.S.C. § 2511(2)(c)-(d). Note that stored data is covered by different laws than communications. It's a nuance. Is it ethical to sniff all the data without giving any other warning than the logon banner? "Ethical" is a very different question than "Legal", and largely more subjective. Most employers require signed consent for monitoring as a condition of employment, and use banners thereafter. That is ethical by my definition, in that it meets or exceeds the requirements of the law, and does not mislead or use subterfuge. The tone of your question suggests you find it distasteful, and therefore probably it violates your personal code of ethics.
Your rights notwithstanding, the government has the power to do such things under appropriate circumstances. First, you would have to be in violation of some ordinance, for instance in Columbus OH you are a violator if the grass is over 12". This should generate a notice informing you what the issue is and giving a deadline for remedy. If you don't comply by the deadline, they are then empowered to send out guys with tools, and the city will bill you for the work. You could call them and ask what the deal is. They might say "We put the notice on your gate", or "we mailed it to you". From a legal POV, the onus is on them to be sure that you're notified. It would be a good idea to verify that this isn't a scam. [Addendum] Bryan TX kindly provides a video about code enforcement, and gives a link where you can go directly to the section of interest (starting 0:43). Your description of the situation is at variance with what they say is the law (12"; 7 day advance notice whereafter they will correct the violation. They also say no notice is required for second violation within a year; $100 administration fee added to costs; lien will be placed on property if unpaid). I assume that your back yard is publicly visible: they recognize that "when the area observed is plainly visible, from a vantage point where the Code Officer has the right to be there, there is no reasonable expectation of privacy". That could include visible from a neighbor's property if the inspector has permission from the neighbor to be there. Otherwise, there's a simmering 4th Amendment problem (assuming that they didn't get a search warrant).
I haven't used the extension, but here are the concerns I would have: Does RECAP detect and handle documents filed under seal? Under some circumstances, IIRC, Pacer gives certain attorneys access to documents sealed from the general public. If you access these sealed documents through PACER and thereby submit them to the RECAP public repository, you have violated the Court order sealing the documents and might well be found in contempt. It is not unheard of for a Court to order a document replaced by a corrected version; this is most common when a document was inadvertently filed with information not redacted that should have been. As long as nobody but the parties and their lawyers have accessed it, this can prevent that information from being public. If you log on to PACER and see your client's personal information...you can no longer keep it private by asking the Court for that remedy, because you just submitted it to a public repository. Enjoy your malpractice suit. Does the use of RECAP constitute a waiver of work product protection? Under some (admittedly limited) circumstances, your use of PACER might constitute attorney work product, which would ordinarily be protected from disclosure in a manner similar to a privilege. Revealing your research pattern to a third party could waive that protection.
GDPR is not a blanket ban on the handling of personal data. It is a set of guidelines when and how data may be processed and stored. Documenting the compliance with a deletion request is one of many purposes for which some data may be retained after a deletion request. Others would be past contractual obligations, legal documentation requirements, and even a balance of 'legitimate interests' of the processors and the data subjects. The processor might be able to argue that fraud/abuse prevention is such a legitimate interest. What if I want to create a service that does let users enter their friends' email addresses, and send those friends an email invitation to the service? Get a specialist lawyer on staff who can check your exact business processes. A web site like this cannot possibly give you a full explanation of the pitfalls.
Obtaining consent for cookies is not required by the GDPR at all. Instead it is covered by the e-privacy directive, which as a directive rather than a regulation, must be implements by specific legislation in each individual country. The exact requirements vary with the law of each country. An e-privacy regulation has been proposed, which would have scope similar to the GDPR, would replace the Directive, and would not require national implementing legislation. However it has not yet been adopted. Proposed versions have significantly different requirements than the current Directive. Nor does the GDPR require consent for advertising that does not involve the processing of personal information, unlike some other privacy laws such as the California CCPA. However, if the Google package sets cookies without consent that are not strictly necessary for operation of the web site, it might well fail compliance with some of those national laws implementing e-privacy. Also, even necessary cookies must be disclosed to the user, as I understand it, possibly only in general terms. Several national Data Protection agencies have said that cookie compliance is not a major priority, at least not until an e-privacy regulation is in place. But that does not mean that lack of compliance is legal. Unfortunately I see no way for a developer using the Google package to correct this issue within the package. One would either have to implement a different solution, or trust that Google will fix this before enforcement becomes a serious issue. However, the app developer could add a separate general cookie consent banner, and turn off all adds if consent is not given, I believe.